233 million stolen XRP. We're watching every drop.
On October 29, 2026, Binance's XRP hot wallets were drained into a single new account. XRP can't be frozen, so the only thing that matters now is where it goes. This page follows it live, straight from the XRP Ledger, and flags the moment any of it touches a token.
The trail
Every transaction sent by the attacker's account, plus every wallet that received 100,000 XRP or more from it. Updated each time you load this page.
What happened
A first attempt fails
A payment of 42.75M RLUSD to a non-existent account is rejected by the ledger.
XRP starts flowing
The first XRP payment creates the receiving account, rK21t6…zMx.
233,461,943 XRP, in about four minutes
Five Binance hot wallets are emptied by transactions signed with the exchange's own keys.
Parked, and watched
The balance above is read live. If it moves, the trail fills in and the Telegram channel gets the alert.
Why it matters
- XRP can't be frozen. Only exchanges can stop deposits. Watching where the funds go is how the ecosystem reacts.
- Meme pools are the soft spot. If stolen XRP buys into a small XRP Ledger token, that pool ends up holding hacked liquidity. Its holders deserve to know first.
- Self-custody held. Not a single drop came from wallets whose owners held their own keys. That's the whole point of $MYKEYS.
Method
- Source: public XRP Ledger nodes. Your browser reads them directly; nothing passes through our servers.
- Tracked: every transaction sent by the attacker's account, and by any wallet that receives ≥ 100,000 XRP from a tracked wallet (hop by hop, up to 40 wallets in the bot, 10 on this page).
- A token flag means a DEX order, an AMM action, a new trustline or any non-XRP amount: the stolen XRP interacting with a token.
- Exchange labels in the bot come from public exchange-address lists. We publish facts from the ledger and make no claims about identity.
On-chain information only. Not financial advice. $MYKEYS is not affiliated with any exchange or with anyone involved in the incident.