Ripple has frozen approximately $200 million in RLUSD linked to the October 29 Binance security breach. The action placed Ripple alongside Tether and Circle in efforts to restrict stolen stablecoin holdings. The coordinated response also highlighted RLUSD’s freeze controls and growing role in institutional cryptocurrency operations.
Ripple Freezes $200M in RLUSD Following Binance Security Breach
The Binance security incident triggered emergency action from major stablecoin issuers on October 29, 2026. Unauthorized transfers from Binance-linked hot wallets reportedly caused losses estimated at $6.3 billion. The incident now ranks as the largest cryptocurrency theft on record, surpassing the $1.5 billion Bybit hack in 2025.
Binance attributed the breach to a compromised laptop belonging to a DevOps engineer. However, its preliminary investigation found no evidence that attackers accessed private keys. The exchange also committed to covering affected users through its SAFU fund and company reserves.
Following the incident, stablecoin issuers moved to restrict funds connected to the suspected attackers. Tether froze approximately $1.57 billion in USDT, while Circle locked more than $800 million in USDC. Ripple also froze around $200 million in RLUSD linked to the affected wallets.
Ripple’s Senior Vice President of Stablecoins, Jack McDonald, confirmed the company’s response on October 29. He explained that Ripple was coordinating with relevant parties and supporting efforts to investigate the potential exploit. Binance co-CEO Yi He acknowledged Ripple’s action and confirmed the exchange would cover customer losses.
Binance founder Changpeng Zhao also acknowledged the stablecoin issuers’ response. Meanwhile, the coordinated freezes restricted the movement of affected assets across supported blockchain networks. This response placed centralized stablecoin controls at the center of the recovery effort.
RLUSD Freeze Controls Strengthen Ripple’s Institutional Position
The incident highlighted an important difference between regulated stablecoins and decentralized cryptocurrencies. Bitcoin and Ethereum do not have central issuers that can directly freeze individual wallet balances. However, RLUSD includes issuer-controlled functions that allow Ripple to restrict specific holdings under applicable circumstances.
These controls can limit how attackers move stolen stablecoins after a security breach. They can also restrict transfers to decentralized exchanges and other supported platforms. Consequently, issuers gain another mechanism for supporting investigations and protecting affected funds.
The response also highlighted RLUSD’s position in Ripple’s institutional expansion strategy. Ripple recently secured final approval from the Office of the Comptroller of the Currency (OCC) for its national trust bank. The regulatory development strengthens the company’s position in regulated digital asset custody and financial services.
Standard Chartered also introduced institutional custody services for RLUSD through its Dubai International Financial Centre branch. Additionally, Robinhood partnered with Ripple to expand RLUSD adoption across its platform. These developments have expanded the stablecoin’s presence across institutional and trading services.
Binance had also increased RLUSD support through XRP rewards campaigns before the security incident. That expansion helped push the stablecoin’s market capitalization beyond $2.4 billion. As a result, the exchange held significant RLUSD balances when Ripple initiated the freeze.
Binance Prepares To Restore Withdrawals After The Attack
Binance expects to resume withdrawal services within 48 hours after completing the required remediation work. The exchange also plans to release a full post-mortem report covering the incident. Furthermore, it intends to provide proof-of-reserves information following the recovery process.
The preliminary investigation found no evidence of compromised private keys. However, the compromised DevOps engineer’s laptop remains central to the reported breach. Binance has also guaranteed full compensation for affected customers through its available financial reserves.
The incident has placed additional attention on stablecoin issuer controls and exchange security practices. Ripple’s intervention demonstrated how centralized issuers can restrict assets linked to suspected criminal activity. Meanwhile, the recovery process will determine how Binance restores services and addresses the wider security implications.
