Binance Hacker Splits 233.46 Million XRP Into Six Whale Wallets

Bitquery traced the redistribution of 233.46 million XRP stolen from Binance into seven new wallets on Nov. 2, creating six addresses that now hold more than one million tokens each. The transfer activity increased the count of large holders without any new buying pressure on the market.

Redistribution Mechanics

Binance’s Nov. 3 report confirmed that five of its hot wallets sent the stolen XRP to an attacker-controlled address between 20:05 and 20:09 UTC on Oct. 29. Bitquery’s analysis shows that this single receiving account was subsequently split into seven distinct new accounts. Five of these recipients received exactly 40,001,000 XRP each, while one received 33,455,920 XRP. A seventh account received a smaller, unspecified amount.

This specific distribution pattern resulted in a net increase of five addresses holding at least one million XRP. The calculation assumes the original sender was already counted as a large holder and that all six new recipients met the threshold after the transfer. Because the tokens originated from a single pool of stolen assets, the rise in whale counts reflects a change in address structure rather than an accumulation of new capital.

Market Data and Exchange Response

CryptoQuant analyst Amr Taha reported that the share of smaller transfers in XRP exchange outflows rose from 17% on Sept. 30 to 33.4% on Oct. 29. This shift in transfer size does not confirm an increase in independently held balances, as transfer volume alone cannot verify whether a recipient is a new investor or part of a redistribution scheme.

CryptoQuant also reported that Binance’s XRP spot-to-futures trading-volume ratio stood at 33.44% on Oct. 28. This metric indicates that for every $100 traded in futures, $33.44 was traded in the spot market. As of Nov. 3, Bitquery reported no further movements from the seven recipient wallets, leaving the attacker’s next steps unclear.

Binance stated in its Nov. 3 update that it would absorb the financial impact of the attack. The exchange noted that 98% of the impacted token assets had been replenished as of Oct. 31. The traced split highlights the importance of verifying the origin of large balances before interpreting rising wallet counts as a bullish signal.