XRP Under Siege: Stolen Binance Coins, a Tech Rout and a Patch That Fixes the Wrong Kind of Bug

XRP changed hands near $1.20 on Thursday, and the forces bearing down on the token are arriving from three unrelated directions at once. A North Korean-linked crew is still sitting on a hoard of stolen tokens. A selloff in US technology stocks has spilled into crypto. And a quiet ledger upgrade has closed a permissions loophole that never touched the native coin in the first place.

The Heist That Won't Go Away

Roughly 42 million of the XRP taken in the Binance breach have now been swapped, mostly into Bitcoin, according to blockchain analytics firm Elliptic. At prevailing prices that tranche was worth about $50 million. The perpetrators routed the bulk of the conversions through THORChain.

That leaves around 192 million XRP, valued at approximately $226 million, still unconverted — a pool that could weigh on the market if it gets moved through swap services in the weeks ahead. Elliptic's figures cover transactions already completed alongside the balance that remains.

The original attack took place on October 29, when 233.46 million XRP were drained from five hot wallets. The FBI has attributed the campaign to TraderTraitor, a North Korean operation.

Exchange Flows Cut Both Ways

Separately, CryptoQuant analyst Darkfost flagged an outflow of 418.5 million XRP from Binance on Wednesday — about $540 million, and the heaviest single-day withdrawal in nine months. Internal transfers may account for part of the movement, Darkfost noted.

Read optimistically, a shrinking exchange float signals tokens moving into longer-term custody. But that interpretation only holds if fresh buying shows up to meet it, and demand has been thin. US spot XRP ETFs logged no net inflows from Tuesday through Wednesday. October's haul came to $18.8 million, a steep drop from $121.4 million in September.

A separate tally of issuer-reported holdings recorded net redemptions of 64,826 XRP on Wednesday, while an assessment for Thursday showed a net flow of zero — though that reading rested on only partial reporting. On October 29, by contrast, the funds had pulled in $8.43 million. Given the gaps in recent data, pinning the current selling pressure on the ETF complex is difficult.

Risk-Off Tide Swamps the Tape

The broader backdrop did XRP no favors. Wednesday's slide in US tech stocks carried over into crypto, with media reports pointing to liquidations of leveraged positions as an accelerant. XRP was changing hands at $1.19, down 1.4% on the day, having traded at $1.20 earlier.

Chartist Casi Trades expects further weakness after a near-term support level gave way. She identifies $1.125 as the next floor and $1.10 as the primary downside target. Should the correction deepen, she sees a lower objective at $0.87. The one thing that could steady the picture, in her view, is a bullish RSI divergence forming at that primary target — if it actually materializes.

A Patch, a Partnership, a Longer Game

On the network side, the fixCleanup3_4_0 amendment went live on Wednesday. The package repairs a flaw in delegated permissions for issued tokens: under certain conditions, accounts authorized to destroy such tokens could also have minted them. Native XRP sat outside the bug's reach, and no exploitation had been confirmed at the time of reporting.

Further out, Ripple said on October 27 that BNY had added XRP and RLUSD to its digital-asset custody platform. The two firms will also explore institutional blockchain use cases, including tokenized trade finance. The custody piece is already live; the applications remain under review.

For holders, the near-term picture is a tug-of-war between market-wide deleveraging, soft fund demand and the overhang of stolen coins still waiting to be swapped — set against incremental progress on institutional access. What would tip the balance is a confirmed technical stabilization paired with returning demand. Until then, each new conversion of the Binance haul adds another reason for caution.