A redistribution of XRP stolen from Binance created six new accounts above the one-million-token threshold on Nov. 2, showing how large-wallet counts can grow through transfers alone.
Blockchain analytics firm Bitquery traced the split from one receiving account into seven new accounts, with six clearing the million-token threshold.
An address tally can increase through the movement of existing holdings, making its interpretation important before drawing a bullish conclusion.
Six large recipients, one depleted sender
Binance’s Nov. 3 report said five of its hot wallets sent 233.46 million XRP to an attacker-controlled address between 20:05 and 20:09 UTC on Oct. 29.
Bitquery’s address list shows that five Nov. 2 recipients received 40,001,000 XRP each. Another received 33,455,920 XRP, alongside the small seventh account.
For a raw count of addresses holding at least one million XRP, six qualifying recipients replacing one qualifying sender would mean a net increase of five. That calculation requires the sender to have been counted beforehand, all six recipients to qualify afterward, and consistent address coverage and observation cutoffs.
Seven recipients of the stolen XRPAmounts received on Nov. 2, 2026; account addresses are abbreviated. Six recipients exceeded one million XRP. The seventh received 1,000 XRP, too small to see clearly on this linear scale; the exact value remains in the table. These transfers do not establish separate owners or new buying.
CryptoSlateA single pool of stolen XRP can appear as several large balances, without requiring another buyer. Distinguishing redistribution from accumulation involves tracing the tokens’ source and identifying which addresses belong together.
In an Oct. 29 analysis, CryptoQuant analyst Amr Taha reported that smaller transfers’ share of XRP exchange outflows rose from 17% on Sept. 30 to 33.4% on Oct. 29.
Conditional large-address count: from one to sixIllustration for the Nov. 2, 2026 split, limited to the traced sender and recipients.
CryptoSlateThat change does not establish a corresponding increase in independently held balances, and transfer size alone cannot establish whether the recipient is a new investor.
CryptoQuant separately reported Binance’s XRP spot-to-futures trading-volume ratio at 33.44% on Oct. 28, meaning $33.44 of spot turnover for every $100 traded in futures.
The XRP holdings snapshot
Bitquery reported no onward transactions from the seven XRP recipients as of Nov. 3.
Binance said in its Nov. 3 update that it would absorb the attack’s financial impact and that 98% of impacted token assets had been replenished as of Oct. 31.
For investors assessing XRP’s recovery, the traced split puts the origin of large balances ahead of their number.
Rising wallet counts become more informative when they connect to new buying and independently held balances. Here, a transfer of existing stolen tokens is sufficient to explain the creation of six large accounts.
