Editor’s note (October 30, 2026): The closing sentence has been narrowed. It previously read that money carried by “the network itself” sits beyond any freeze switch; the documentation cited here establishes that boundary for XRP on the XRP Ledger, not as a general rule for every network’s native asset.
Ripple joins the freeze effort
Ripple froze its U.S. dollar-backed stablecoin, RLUSD, inside the compromised Binance hot wallet and inside the wallet controlled by the attacker at 22:01 UTC on October 29, 2026 – moving against funds drained in a suspected hot-wallet drain. A stablecoin issuer is a company that issues a digital token pegged to a currency such as the U.S. dollar and keeps the authority to control where those tokens can move.
The intervention shows up in two numbers that are not the same count. On-chain data confirmed by TRM Labs puts the freeze at 40.5 million RLUSD – about US$40.5 million at the dollar peg – out of 88.5 million RLUSD taken from Binance’s wallets. Separately, Binance co-CEO Yi He said Ripple’s actions helped stop about US$200 million from moving, a figure TRM reported. The first number is what TRM verified on the blockchain; the second is Yi He’s estimate. They are not added together. The timing was tight: the attackers had already sold about 48 million of the RLUSD on crypto trading platforms between 21:42 and 22:01 UTC, TRM said, and the freeze caught what was left.
Jack McDonald, Ripple’s senior vice president of stablecoins, said the company was actively freezing affected funds held in RLUSD, CNBC reported. That makes Ripple the third major stablecoin issuer to move in this incident, after Tether and Circle. As of 00:30 UTC on October 30, TRM counted about US$2.67 billion in stablecoins frozen across Ripple, Tether, Circle and World Liberty Financial – roughly US$2.7 billion including a separate US$30 million frozen by the Arbitrum Security Council, a group that can take emergency action on that network. What Tether and Circle specifically did is in our freeze playbook.
The switch, written into the rulebook
Ripple’s power over RLUSD is written into the token’s own rulebook. The company’s RLUSD user terms, last updated October 14, 2026, say in Section 11.5(a): “Ripple may freeze RLUSD by blacklisting a particular digital address rendering the associated digital wallet, which may be a User Wallet, restricted from transmitting or receiving RLUSD at its sole discretion if required to do so by Applicable Law or Ripple’s internal compliance policies. The User agrees that Ripple may blacklist digital addresses holding RLUSD, with or without advance notice.” To blacklist an address is to tag the wallet so it can no longer send or receive the token.
The same section warns that a holder “may lose the entirety of their RLUSD.” The company behind the switch is Standard Custody & Trust Company LLC, a Ripple subsidiary that issues the token.
Where the power stops
None of that reaches XRP, the native asset of the XRP Ledger. A native asset is the network’s own currency, not a token a company issues. The XRP Ledger’s documentation puts it plainly: “Issuers can freeze the tokens they issue in the XRP Ledger. This does not apply to XRP.” And: “No one can freeze XRP in the XRP Ledger.” One caveat in the same documentation: a custodial exchange – a platform that holds customers’ funds for them – can always freeze what it holds on its customers’ behalf.
The stolen XRP shows the difference in practice. TRM counted 233.46 million XRP, about US$296 million, taken from Binance wallets when the attack began on October 29, and writes that “That XRP has remained in place since.” No company issues XRP, so no company can tag it.
That leaves anyone sizing up a stolen crypto haul with two columns. Money an issuer controls can be blacklisted within hours – TRM counted four issuers doing exactly that inside one night. On the XRP Ledger, the network’s own asset sits beyond an issuer’s switch: the documentation says no one can freeze XRP there, and the stolen XRP is still sitting where it landed.