Ripple Freezes RLUSD Tied to Binance Hack: What an Issuer Freeze Does

Ripple has frozen RLUSD, its dollar stablecoin, held by the attackers behind the large transfers out of Binance hot wallets on October 29. How much it froze is less clear. Binance co-CEO Yi He put the figure at about $200 million. Blockchain analytics firm TRM Labs verified a much smaller number: 40.5 million RLUSD, out of 88.5 million it says were taken.

For anyone holding RLUSD, this is a rare look at a power that usually sits in the background. The issuer can stop specific addresses from moving the coin. Here, that power helped contain part of a theft. The same power covers every holder's balance, the attacker's and yours alike.

Two Numbers for One Freeze

Jack McDonald, Ripple's senior vice president of stablecoins, said on X that Ripple was "closely monitoring reports of a potential exploit involving Binance and its attackers' RLUSD holdings and we are actively freezing affected funds."

Yi He later thanked "the Ripple team for promptly freezing approximately 200 million" and said user funds were safe. Both are posts by interested parties. Their wording comes through published reports, as the posts themselves could not be read directly.

The figures attributed to TRM Labs tell a narrower story. Ripple froze attacker-linked RLUSD at 22:01 UTC on October 29. By then, about 48 million RLUSD had already been swapped through decentralized exchanges, leaving 40.5 million in the affected wallet. Some of the swapped RLUSD went into ether before the freezes took full effect.

Blockchain investigator Range is reported to have confirmed that timeline, with the first freeze at 22:01 UTC and a further restriction at about 22:20 UTC. Ripple also restricted RLUSD inside Binance's compromised hot wallet.

TRM independently verified only the $40.5 million freeze. Nothing published so far reconciles that with Yi He's $200 million.

The Stolen XRP Is Out of Ripple's Reach

The same attackers are reported to have taken 233.46 million XRP, worth about $296 million, from five Binance wallets earlier that evening. Ripple cannot freeze any of it.

The XRP Ledger documentation is blunt about why: "Issuers can freeze the tokens they issue in the XRP Ledger. This does not apply to XRP, which is the native asset of the XRP Ledger, not an issued token." RLUSD has an issuer, a Ripple subsidiary. XRP has none.

The documentation names one exception. "No one can freeze XRP in the XRP Ledger. However, custodial exchanges can always freeze the funds they custody at their own discretion." That control covers XRP held on an exchange's books, which is a different thing from Ripple stopping a transfer.

What a Freeze Does to a Holder

One caution first: none of the reports say which blockchain the frozen RLUSD sat on. The rules below show how freezes work on the XRP Ledger, not necessarily the exact steps Ripple took here.

• Individual freeze: the holder "can only send the frozen currencies directly to the issuer," and any offers to sell the token become unfunded.
• Deep freeze: the holder "can no longer send nor receive from others on the deep-frozen trust line."
• Scope: the issuer can freeze a holder's line for its own token only. In the documentation's words, issuers "can't freeze the rest of your account, or any tokens from different issuers, and they can't stop you from using the XRP Ledger."

A freeze locks money in place. It does not move it. The XRP Ledger offers issuers a separate tool, clawback, which lets them reclaim tokens from a holder if the feature was enabled in advance. "Clawback transactions can claw back funds even when those funds are frozen," the documentation says.

No report so far says Ripple has clawed back any RLUSD. Freezing stolen tokens does not by itself return them to Binance or repay its customers.

Ripple Was One of Several Issuers Freezing Funds

RLUSD was a small slice of this incident. Binance has said user funds are safe and that the verified amount frozen across all assets stood at $2.54 billion as of October 30. It has not confirmed a total loss figure.

Reports put Tether's freeze at about $1.57 billion in USDT and Circle's at more than $800 million in USDC, with the total impact estimated at about $6.3 billion. Those figures come from reports rather than from the issuers' own statements. Binance is reported to have blamed the breach on a DevOps engineer's compromised laptop, with no evidence of a private key leak.

The same controls that let stablecoin issuers trap stolen funds also let them restrict legitimate users under certain conditions. Holders of RLUSD, USDT and USDC have always carried that trade-off. This week it worked against an attacker.

Two questions remain open: whether Ripple will claw back the frozen 40.5 million RLUSD, or more if Yi He's figure holds, and what Binance finally confirms it lost.