A redistribution of 233.46 million XRP stolen from Binance on Oct. 29 created six new accounts exceeding one million tokens each by Nov. 2, illustrating how large-wallet counts can expand through token transfers alone rather than fresh buying activity.
Five Binance hot wallets sent the stolen XRP to an attacker-controlled address between 20:05 and 20:09 UTC on Oct. 29. The attacker then split the tokens across seven new wallets. Five recipients each received 40,001,000 XRP, while a sixth received 33,455,920 XRP. A seventh account received a smaller unspecified amount.
Binance disclosed the incident in a report on Nov. 3. The exchange stated it would absorb the financial impact and had replenished 98% of impacted token assets as of Oct. 31.
Whale Metrics and Transfer Activity
The creation of six new addresses above the one-million-token threshold raises questions about the reliability of whale-count metrics as bullish indicators. A net increase of five addresses to large-holder counts would result if the original sender was previously counted in whale tallies and all six recipients qualified afterward.
CryptoQuant reported that smaller transfers’ share of XRP exchange outflows increased from 17% on Sept. 30 to 33.4% on Oct. 29, the same day as the theft. On Oct. 28, Binance’s XRP spot-to-futures trading-volume ratio stood at 33.44%.
No Further Movement
Bitquery reported on Nov. 3 that no further movements had occurred from the seven wallets since the initial redistribution. The hacker’s identity remains unknown.
