Ripple Freezes $200M RLUSD as Binance Faces Record $6.3B Hack

HIGHLIGHTS Ripple froze about $200M in RLUSD linked to a potential exploit on Binance, which estimates total losses near $6.3B. Tether froze roughly $1.57B in USDT and Circle locked over $800M in USDC in coordinated issuer action. Binance says user funds remain SAFU, withdrawals should resume within 48 hours, and no private keys were compromised. Ripple’s Senior Vice President of Stablecoins, Jack McDonald, confirmed on October 29 that the company is actively freezing RLUSD holdings linked to a potential exploit on Binance, the largest crypto security incident on record.

The move positions RLUSD as a regulated stablecoin built to respond in real time when institutional safeguards matter most.
Ripple Acts Fast as Binance Hack Drains $6.3B from Hot Wallets
On October 29, 2026, large unauthorized transfers left Binance-linked hot wallets. Estimates put total impact at roughly $6.3B, making it the biggest crypto theft ever recorded, surpassing even the $1.5B Bybit hack from 2025.

Binance attributed the breach to a compromised DevOps engineer’s laptop, with no evidence of any private-key leak.

Coordinated issuer action followed almost immediately. Tether froze roughly $1.57B in USDT, while Circle locked over $800M in USDC.

Ripple joined that effort by freezing approximately $200M in RLUSD, a move Binance co-CEO Yi He publicly acknowledged on X, confirming that user funds remain SAFU and that Binance will cover all losses through the SAFU fund and company reserves.

Thanks to the Ripple team for promptly freezing approximately 200 million.
User Funds are SAFU.

— Yi He (@heyibinance) October 29, 2026

McDonald’s post on X described Ripple as “closely monitoring reports of a potential exploit involving Binance and its attackers’ RLUSD holdings.”

He added that the company is coordinating with relevant parties and stands ready to support any investigation to protect users. CZ, Binance’s founder, also acknowledged the issuer freezes on X.
Why RLUSD’s Freeze Capability Signals Strength for Institutional Stablecoin Confidence
Unlike fully decentralized assets such as ETH or BTC, which no issuer can freeze, RLUSD’s built-in freeze function is a deliberate institutional design choice.

It limited attacker exit options. It reduced the window for converting stolen holdings into untraceable assets on DEXs like Uniswap.

And it demonstrated the operational readiness that banks, custodians, and corporate treasuries look for when evaluating a stablecoin for real-world use. That institutional track record has been building steadily.

Ripple recently secured final OCC approval to operate a national trust bank, a regulatory milestone that underpins RLUSD’s compliance architecture.

Standard Chartered followed by launching institutional custody for RLUSD through its DIFC branch. Robinhood also partnered with Ripple to expand RLUSD adoption across its platform.

Just weeks before the incident, Binance itself had expanded support for RLUSD via XRP rewards campaigns, helping push RLUSD’s market cap past $2.4B.

That same custodial relationship meant Binance held meaningful RLUSD balances, which is precisely why the freeze carried weight.

The ability to protect those funds in real time reinforces what McDonald said when Standard Chartered’s custody went live: RLUSD was built for exactly this kind of institutional use case.

Binance has said withdrawal services are expected to resume within 48 hours. A full post-mortem and proof of reserves will follow remediation. The exchange’s initial investigation confirms no private keys were compromised, and Binance guarantees full user coverage.