AI summary
- The Binance breach affected exchange wallet-signing infrastructure, with no evidence of an XRP Ledger compromise. Ripple froze 40.5 million stolen RLUSD; native XRP has no equivalent issuer-level freeze.
- Binance reported replenishing about 90% of stolen assets before withdrawals reopened. Recovery progress does not mean the technical investigation is complete.
- Coinbase expands RLUSD access across retail and institutional platforms on XRPL, Ethereum and Base. Multichain stablecoin growth is not automatically XRP demand.
- Robinhood plans broader Ripple integrations, while BNY’s XRP and RLUSD custody support is already available. Planned settlement services and proprietary token purchases remain distinct from custody.
- C2FO’s proposed Instant Pay service connects invoice financing with RLUSD settlement on XRPL. Its $520 billion figure describes historical working-capital activity, not XRPL-settled volume.
- Ripple’s $900 million target is a projected annualized product-revenue run rate, not verified full-year revenue. Institutional adoption must still translate into measurable usage and XRP demand.
The crypto market has just experienced its largest recorded security breach, and XRP and Ripple's stablecoin, RLUSD, are directly involved.
Meanwhile, Ripple has announced several significant institutional developments involving Coinbase, Robinhood, BNY and C2FO. Together, these developments reveal two sides of the evolving digital-asset economy: the importance of secure financial infrastructure and the expanding role of blockchain in traditional finance.
Binance's $6.3 Billion Hack: XRP Stolen, RLUSD Frozen
On October 29, Binance suffered a massive security breach involving approximately $6.36 billion in digital assets across ten blockchains, according to blockchain intelligence firm TRM Labs.
The FBI has attributed the attack to North Korea's TraderTraitor hacking group, the same operation linked to the $1.5 billion Bybit exploit in February 2025.
What makes this particularly relevant to the XRP ecosystem is how the attack unfolded.
Between 20:05 and 20:09 UTC, five Binance wallets transferred approximately 233.46 million XRP, valued at $296 million at the time, to an attacker-controlled address.
These were the first identified transfers in the attack. Importantly, there is no evidence that the XRP Ledger itself was compromised. TRM's investigation instead points toward compromised exchange wallet-signing infrastructure that allowed unauthorized transactions across multiple networks.
RLUSD was also affected.
Of the 88.5 million RLUSD stolen on Ethereum, approximately 48 million were converted through decentralized exchanges before Ripple intervened. Ripple successfully froze the remaining 40.5 million RLUSD in an attacker-controlled wallet.
That distinction is significant. RLUSD, as an issuer-controlled stablecoin, has mechanisms that can restrict transfers associated with illicit activity. XRP, being a decentralized native asset without a central issuer, does not offer equivalent issuer-level freezing capabilities.
This presents institutions with an important trade-off. Stablecoins can provide familiar compliance and recovery controls, while native cryptocurrencies offer different properties, including greater resistance to issuer intervention.
Binance's Recovery Is Now Being Tested
By October 31, Binance reported replenishing approximately 90% of the stolen assets using corporate funds, insurance reserves and its user protection fund.
Withdrawals began reopening on November 1. During the first nine and a half hours, customers withdrew $4.65 billion while depositing $1.01 billion, producing approximately $3.64 billion in net outflows.
That represents 2.1% of Binance's reported $171 billion in assets.
The exchange says withdrawals are stabilizing, although the full technical investigation remains incomplete.
For institutional investors, the lesson extends beyond Binance. Exchanges, custodians and payment providers need stronger authorization controls, asset segregation and credible recovery procedures. Ripple's growing institutional custody and compliance businesses operate in a market where those requirements are becoming increasingly important.
Coinbase Opens a Major New Distribution Channel for RLUSD
RLUSD promotional graphic supplied in the approved Issue 032 Google Doc; not a photograph of the Coinbase announcement.
On October 28, Ripple and Coinbase announced a partnership making RLUSD available across Coinbase's retail and institutional platforms.
Customers can now access RLUSD through Coinbase Prime, Coinbase Exchange and the Coinbase retail application.
The integration also supports deposits and withdrawals across three blockchain networks:
- XRP Ledger
- Ethereum
- Base
Coinbase plans to introduce additional institutional functionality, including RLUSD collateral support on Coinbase Global Exchange.
Jack McDonald, Ripple's SVP of Stablecoins, emphasized the importance of making institutional stablecoins available through established execution, custody and settlement platforms.
This is a meaningful expansion of RLUSD's distribution. Institutions can now access the stablecoin through familiar trading and custody infrastructure rather than having to establish entirely new relationships.
The XRPL connection is direct: RLUSD can be issued and transferred on the network, generating transaction activity that requires XRP for fees and reserves.
However, Coinbase also supports RLUSD on Ethereum and Base. Growth in RLUSD's overall market capitalization therefore cannot automatically be treated as equivalent growth in XRPL activity or native XRP demand.
Ripple, Robinhood and BNY Expand Institutional Infrastructure
Ripple's October 27 announcements introduced two additional institutional relationships.
Robinhood Moves Beyond Trading
Ripple and Robinhood announced a strategic partnership covering stablecoins, institutional trading and treasury management.
RLUSD is already available on Robinhood Chain and Bitstamp by Robinhood, with availability in Robinhood's consumer application planned for later this year.
Robinhood also plans to use RLUSD on the XRP Ledger for institutional settlement, while integrating Ripple Treasury into its corporate cash-management operations.
The relationship extends to Ripple Prime, which provides financing and liquidity services associated with Bitstamp's institutional business.
The significance is the combination of several financial functions within an established trading platform. Ripple is no longer approaching institutions exclusively through cross-border payments. Its infrastructure now extends into corporate treasury, financing, market access and stablecoin settlement.
Actual XRP settlement demand, however, will depend on the assets and transaction routes institutions ultimately choose.
BNY Adds XRP and RLUSD Custody
BNY has expanded its relationship with Ripple by adding support for XRP and RLUSD to its Digital Asset Custody platform.
Unlike a proposed integration, this custody support is already available.
The companies also intend to explore direct RLUSD minting and redemption for BNY clients, alongside additional tokenized-asset and trade-finance services.
Ripple President Monica Long described the next phase of tokenization as making digital assets usable for payments and collateral rather than merely issuing them on-chain.
That shift is important. Institutional custody creates the foundation for holding assets securely, while settlement and collateral services determine how those assets can be used in financial markets.
For XRP, institutional custody support is a concrete infrastructure development. It does not establish that BNY is accumulating XRP for proprietary investment or deploying XRP as settlement liquidity.
C2FO Brings Commercial Working Capital Into XRPL's Reach
One of Ripple's most interesting recent announcements involves C2FO, a global working-capital platform.
C2FO helps businesses receive payment earlier against approved invoices. Its existing early-payment programs have facilitated more than $520 billion in working capital.
On October 27, Ripple and C2FO announced an initiative to support C2FO Instant Pay using the XRP Ledger and RLUSD.
Under the proposed model, participating capital providers fund approved invoices, while suppliers receive settlement through RLUSD on XRPL.
This could reduce the delays businesses experience between obtaining financing approval and receiving usable cash.
The distinction is that C2FO already operates a substantial commercial financing platform. Ripple is seeking to introduce blockchain settlement into an existing financial process rather than creating demand for an entirely new speculative product.
The service is still being rolled out, with interested businesses directed to a waitlist. The $520 billion represents C2FO's historical working-capital activity, not transactions already settled on XRPL.
Nevertheless, this creates a credible route toward connecting tokenized receivables, institutional capital and stablecoin payments.
Ripple Targets a $900 Million Annual Product Revenue Run Rate
Ripple also used its Swell 2026 announcements to provide a broader picture of its business.
On October 28, the company said it expects to exit 2026 with approximately $900 million in annualized product revenue.
Ripple also reported that the number of customers and partners using multiple products had tripled during the year.
The company now describes an institutional network spanning more than 1,700 institutions, corporates and enterprises, supported by more than 85 licenses.
These figures highlight Ripple's expansion beyond its original payments business.
Its platform now encompasses payments, custody, stablecoins, prime brokerage and corporate treasury management.
But the $900 million figure is a projected annualized run rate, not verified full-year revenue. Similarly, Ripple's corporate transaction volumes should not be confused with XRP-denominated settlement or XRPL on-chain activity.
The important commercial question is whether Ripple can convert its institutional relationships into recurring product usage, transaction revenue and sustained network activity.
Final Thoughts
Two developments now deserve particular attention.
First, the Binance attack has demonstrated both the vulnerabilities of centralized asset-management infrastructure and the practical role issuer controls can play during a financial security incident.
Second, Ripple's recent partnerships suggest a more integrated institutional strategy. Coinbase expands RLUSD distribution, Robinhood connects multiple Ripple businesses, BNY strengthens custody infrastructure, and C2FO introduces a practical commercial settlement use case.
The XRP Ledger is increasingly being positioned for institutional financial activity. The next stage is demonstrating how much of that activity actually settles on XRPL and how much demand it creates for XRP itself.
Partner spotlight
Crypto and precious metals for your retirement
Buy XRP, XLM, gold & silver in a tax-advantaged IRA.
$100 funding bonus when you open and fund a new IRA or PCA.*
Get started*Terms and conditions apply.
Sources
TRM Labs — Binance Hack Investigation
FBI — North Korea Responsible for Binance Attack
Binance — Security Incident Recovery Update
https://www.binance.com/en/square/post/383244799724069
Binance — November 1 Withdrawal Activity
https://www.binance.com/en/square/post/383630607309696
Ripple — Coinbase Partnership
https://ripple.com/ripple-press/ripple-and-coinbase-partner-to-expand-access-to-rlusd/
Ripple — Robinhood Partnership
BNY — Ripple Custody and Trade Finance Expansion
Ripple — C2FO Trade Finance Partnership
Ripple — 2026 Product Revenue and Institutional Growth