XRP news today is dominated by two sharply contrasting storylines: a historic security breach that sent prices tumbling, and a string of institutional milestones that may reshape the token’s long-term trajectory. Both landed within the same 48-hour window, making this one of the most eventful stretches for the XRP ecosystem in months.
The bigger shock came first.
On October 29, 2026, an attacker moved approximately $6.36 billion out of Binance wallets across ten blockchains, with most of the funds drained in about 20 minutes starting at 20:05 UTC.
The theft began specifically on the XRP Ledger, where five Binance wallets sent 233.46 million XRP — worth about $296 million at the time — to a single attacker-controlled address.
Binance’s early investigation suggested the breach may have involved a compromised DevOps engineer’s laptop, which allowed unauthorized withdrawal transactions to be submitted.
Two of the most respected names in blockchain forensics pointed the same direction for attribution.
TRM Labs attributes the attack with high confidence to TraderTraitor, the North Korean group the FBI named in the $1.5 billion Bybit hack of February 2025 — with TRM counting roughly $6.36 billion leaving Binance wallets, about four times the Bybit total.
Chainalysis co-founder and CEO Jonathan Levin also said the hack was likely carried out by TraderTraitor, citing links to a previous hack.
No government or law enforcement agency has confirmed attribution, and Binance has not commented on who was responsible.
For XRP holders, the immediate concern is what happens to the stolen tokens.
Elliptic confirmed that the stolen XRP has not moved since the theft.
That idle posture is a double-edged sword: no selling pressure yet, but the prospect of a future dump remains an overhang.
More than $3 billion of the stolen assets, including 233 million XRP sitting in a single address, can now only be stopped when they reach an exchange or other service.
On the response side,
freezes by Tether, Circle, Ripple, World Liberty Financial, and Arbitrum’s Security Council reached approximately $2.7 billion by early October 30.
Binance pledged to reimburse victims using its Secure Asset Fund for Users and company reserves.
The hack overshadowed what had been a banner few days for Ripple itself.
The OCC gave final approval for Ripple National Trust Bank’s national bank charter on October 26 — completing a process that had started with conditional approval in December 2025.
The federally supervised bank is authorized to manage RLUSD reserves, act as collateral trustee for RLUSD holders, and provide digital asset custody services.
Then at Ripple’s Swell 2026 conference in New York the following day, the company unveiled a slate of institutional deals.
Ripple announced expanded partnerships with Robinhood and BNY, with Ripple and Robinhood broadening cooperation to cover RLUSD distribution across Robinhood’s retail and institutional businesses, alongside treasury management, lending, and trading integrations.
BNY now provides custody for XRP and RLUSD through its Digital Asset Custody platform, and Ripple and BNY plan to enable BNY clients to mint and redeem RLUSD directly, as well as expand support for tokenized assets issued on the XRP Ledger.
Ripple also reported it is on track to exit 2026 with $900 million in annualized product revenue.
On the protocol side,
XRP Ledger developers proposed four fixes to close exceptions that allow restricted tokens to reach accounts without their issuers’ approval — with the changes limiting unapproved holders to returning tokens to the issuer unless approval is granted.
The fixes have not been merged into the network’s main software and would require support from more than 80 percent of trusted validators for two consecutive weeks before activation.
The XRP Ledger Foundation characterized this as routine protocol hardening, not a security incident, with no reports of affected users.
As for price,
XRP was trading at $1.24, down 3.50% in 24 hours and 5.80% over seven days, according to CoinGecko.
XRP had been falling since early October, when it was trading close to $1.50.
On-chain data offered a more nuanced picture:
active accounts on the XRP Ledger reached 32,604 on October 27 — the highest reading since the start of 2026 and well above the 30-day average of 19,400.
What to watch next: whether the attacker begins moving or laundering the 233 million stolen XRP is the single most important near-term variable for price. Traders should also monitor whether Binance resumes normal withdrawals, the pace at which frozen funds are recovered, and whether the Swell partnership announcements translate into measurable on-chain activity for the XRP Ledger in the weeks ahead.
This article is for information only and is not financial advice. Crypto prices are volatile; always do your own research.