- Ripple said on October 29, 2026 that it is freezing approximately $200 million in RLUSD holdings linked to a suspected exploit at Binance.
- Estimates put the total impact of the breach at roughly $6.3 billion, which would make it the largest crypto theft on record.
- Tether and Circle also froze USDT and USDC, and Binance says user funds remain covered by its SAFU fund and company reserves.
Ripple’s Senior Vice President of Stablecoins, Jack McDonald, confirmed on October 29, 2026 that the company is actively freezing RLUSD holdings tied to a potential exploit involving Binance. The incident is being described as the largest security breach in crypto history, and the response has drawn attention to the role stablecoin issuers can play in limiting losses.
What Happened
On October 29, 2026, large unauthorized transfers moved out of Binance-linked hot wallets. Estimates place the total impact at roughly $6.3 billion, which would exceed the $1.5 billion Bybit hack recorded in 2025.
Binance has attributed the breach to a compromised laptop belonging to a DevOps engineer. The exchange has stated that there is no evidence of a private-key leak.
Several stablecoin issuers moved quickly after the transfers. Tether froze roughly $1.57 billion in USDT, and Circle locked more than $800 million in USDC. Ripple added to these actions by freezing approximately $200 million in RLUSD.
Binance co-CEO Yi He publicly thanked the Ripple team on X for acting promptly. In a post dated October 29, 2026, he wrote that approximately 200 million had been frozen and that user funds are SAFU, the exchange’s safety fund. Binance has said it will cover all losses through the SAFU fund and company reserves.
McDonald posted on X that Ripple was “closely monitoring reports of a potential exploit involving Binance and its attackers’ RLUSD holdings.” He said the company is coordinating with relevant parties and is prepared to support any investigation aimed at protecting users. Binance founder CZ also acknowledged the issuer freezes on X.
Why It Matters
The response highlights a difference between stablecoins and fully decentralized assets such as ETH and BTC. No issuer can freeze those assets, whereas RLUSD includes a built-in freeze function that Ripple can use when it judges that a situation calls for it.
According to the reasoning in the source report, the ability to freeze funds can limit an attacker’s options. Freezing holdings can reduce the time available to convert stolen assets into harder-to-trace forms, such as swaps on decentralized exchanges like Uniswap.
For institutional investors, banks, custodians, and corporate treasuries, the episode offers a real-world test of how an issuer responds under pressure. Such users often weigh an issuer’s operational readiness when considering a stablecoin, and the speed of the freezes will likely be part of that assessment. The episode also shows the tradeoff: a freeze mechanism gives issuers control that fully decentralized assets do not offer, and that control is central to the debate over stablecoin design.
Market Context
Ripple has been building a broader institutional profile for RLUSD. According to the source, the company recently secured final approval from the Office of the Comptroller of the Currency (OCC) to operate a national trust bank. The source describes this as a regulatory milestone supporting RLUSD’s compliance framework.
The source also reports that Standard Chartered launched institutional custody for RLUSD through its DIFC branch, and that Robinhood partnered with Ripple to expand RLUSD adoption on its platform. Weeks before the breach, Binance had expanded support for RLUSD through XRP rewards campaigns, and the source says these efforts helped push RLUSD’s market capitalization past $2.4 billion.
Binance’s relationship with RLUSD meant the exchange held meaningful RLUSD balances, which made the freeze significant for the exchange’s own recovery. The previous largest comparable incident referenced in the reporting was the 2025 Bybit hack at $1.5 billion, which is now well below the current estimate.
What to Watch Next
Readers should follow several developments in the coming days and weeks:
- Withdrawal resumption: Binance has said withdrawal services are expected to resume within 48 hours. Whether that timeline holds will be an early indicator of the exchange’s recovery.
- Post-mortem and proof of reserves: Binance has said a full post-mortem and proof of reserves will follow remediation. These documents should clarify the scope of the breach and the state of user balances.
- Loss figures: The $6.3 billion figure is an estimate. Updated numbers from Binance or independent analysts may revise it.
- Investigation updates: Ripple has said it will support any investigation. Any findings on the attackers, or on the movement of frozen funds, would be important for assessing how effective issuer freezes were.
- Regulatory response: Given the scale of the incident and the role of stablecoin issuers, regulators may take an interest in freeze powers and exchange security practices.
Source: original report
