Key takeaways Ripple froze $40.5 million in attacker-linked RLUSD Hackers also stole $296 million in native XRP XRP cannot be frozen through issuer-controlled token restrictions Ripple succes
Ripple successfully froze approximately $40.5 million in stolen RLUSD following Binance's $6.3 billion security breach, but it could not stop hackers from holding or transferring another $296 million in native XRP.
According to TRM Labs' blockchain investigation, Ripple froze attacker-linked RLUSD at 22:01 UTC on October 29, securing 40.5 million tokens from an initial 88.5 million RLUSD theft.
The intervention highlights a fundamental difference between Ripple's regulated stablecoin and XRP, the native cryptocurrency of the XRP Ledger.
Ripple Froze RLUSD, but Millions Had Already EscapedThe freeze occurred roughly two hours after the attackers began draining Binance wallets across several blockchains.
Before Ripple intervened, approximately 48 million RLUSD had already been exchanged through decentralized trading platforms, leaving 40.5 million tokens in the affected wallet.
Ripple also restricted RLUSD inside Binance's compromised hot wallet, preventing further unauthorized withdrawals of that stablecoin from the affected address.
Independent blockchain investigator Range confirmed the timeline, identifying the initial RLUSD freeze at 22:01 UTC and an additional restriction at approximately 22:20 UTC.
Binance co-CEO Yi He separately said Ripple helped prevent approximately $200 million from moving, although TRM independently verified only the $40.5 million freeze.
The intervention formed part of a wider response involving Tether, Circle and other stablecoin issuers.
As Coinpaper's earlier Binance investigation reported, the exchange said approximately $3 billion in affected cryptocurrency had been frozen.
However, freezing stolen tokens does not automatically mean the assets have been returned to Binance or reimbursed to customers.
Why Ripple Couldn't Freeze $296 Million in XRPThe same attackers had stolen 233.46 million XRP, valued at approximately $296 million, from five Binance wallets earlier that evening.
Coinpaper's XRP theft report traced the transfers to a four-minute window between 20:05 and 20:09 UTC.
Unlike RLUSD, XRP has no central issuer with administrative authority to freeze balances.
The official XRP Ledger documentation explicitly distinguishes native XRP from issued tokens, which can have issuer-controlled restrictions.
RLUSD is issued by a Ripple subsidiary and includes compliance functionality that can prevent specified addresses from transferring the stablecoin.
Native XRP does not use that structure. Ripple cannot blacklist an XRP address or reverse a valid network transaction.
That does not prevent exchanges from freezing XRP deposited into accounts they control, but it limits direct intervention against funds held in independent wallets.
The distinction echoes an earlier XRP freeze controversy, when Ripple's David Schwartz defended stablecoin restrictions while emphasizing the different properties of XRP.
What the Binance Hack Reveals About XRP SecurityThe incident illustrates the trade-off between issuer-controlled financial assets and cryptocurrencies without centralized freezing mechanisms.
Stablecoin controls can help exchanges and investigators contain stolen funds, but they also give issuers the ability to restrict legitimate users under certain conditions.
Native XRP offers stronger resistance to unilateral transaction restrictions, although recovering stolen coins may depend on cooperation from exchanges and other service providers.
We previously documented a similar problem during the Bitget hack, when attackers moved stolen XRP that Ripple could not directly immobilize.
