Quick Take
- The attacker split roughly 233.46 million stolen XRP among seven wallets. Six received more than 1 million XRP each; the seventh received just 1,000 XRP.
- The transfers could inflate XRP whale counts without fresh buying, potentially misleading investors tracking large-holder accumulation.
- Bitquery reported no further movements from the seven wallets as of Nov. 3, leaving the attacker's next move uncertain.
A redistribution of XRP stolen from Binance created six new accounts above the one-million-token threshold on Nov. 2, showing how large-wallet counts can grow through transfers alone.
Blockchain analytics firm Bitquery traced the split from one receiving account into seven new accounts, with six clearing the million-token threshold.
An address tally can increase through the movement of existing holdings, making its interpretation important before drawing a bullish conclusion.
Six large recipients, one depleted sender
Binance's Nov. 3 report said five of its hot wallets sent 233.46 million XRP to an attacker-controlled address between 20:05 and 20:09 UTC on Oct. 29.
Bitquery's address list shows that five Nov. 2 recipients received 40,001,000 XRP each. Another received 33,455,920 XRP, alongside the small seventh account.
For a raw count of addresses holding at least one million XRP, six qualifying recipients replacing one qualifying sender would mean a net increase of five. That calculation requires the sender to have been counted beforehand, all six recipients to qualify afterward, and consistent address coverage and observation cutoffs.
A single pool of stolen XRP can appear as several large balances, without requiring another buyer. Distinguishing redistribution from accumulation involves tracing the tokens' source and identifying which addresses belong together.
In an Oct. 29 analysis, CryptoQuant analyst Amr Taha reported that smaller transfers' share of XRP exchange outflows rose from 17% on Sept. 30 to 33.4% on Oct. 29.
That change does not establish a corresponding increase in independently held balances, and transfer size alone cannot establish whether the recipient is a new investor.
CryptoQuant separately reported Binance's XRP spot-to-futures trading-volume ratio at 33.44% on Oct. 28, meaning $33.44 of spot turnover for every $100 traded in futures.
The XRP holdings snapshot
Bitquery reported no onward transactions from the seven XRP recipients as of Nov. 3.
Binance said in its Nov. 3 update that it would absorb the attack's financial impact and that 98% of impacted token assets had been replenished as of Oct. 31.
For investors assessing XRP's recovery, the traced split puts the origin of large balances ahead of their number.
Rising wallet counts become more informative when they connect to new buying and independently held balances. Here, a transfer of existing stolen tokens is sufficient to explain the creation of six large accounts.
Mentioned in this article
Editorial credits
