A redistribution of XRP stolen from Binance led to the creation of six new accounts holding at least one million tokens on Nov. 2, illustrating how large-wallet counts can rise through transfers alone.
Blockchain analytics firm Bitquery traced the movement from a single receiving account into seven new accounts, six of which cleared the one-million-token threshold.
An address tally can increase through the movement of existing holdings, so such a rise warrants careful interpretation before it is treated as a bullish signal.
Six Large Recipients, One Depleted Sender
Binance’s Nov. 3 report said five of its hot wallets sent 233.46 million XRP to an attacker-controlled address between 20:05 and 20:09 UTC on Oct. 29.
Bitquery’s address list showed that five Nov. 2 recipients received 40,001,000 XRP each, while another received 33,455,920 XRP, alongside a smaller seventh account.
For a raw count of addresses holding at least one million XRP, six qualifying recipients replacing one qualifying sender would mean a net increase of five. That calculation requires the sender to have been counted beforehand, all six recipients to qualify afterward, and consistent address coverage and observation cutoffs.
A single pool of stolen XRP can appear as several large balances without requiring another buyer. Tracing the tokens’ source and identifying which addresses belong together is necessary to distinguish redistribution from accumulation.
The XRP Holdings Snapshot
Bitquery reported no onward transactions from the seven XRP recipients as of Nov. 3.
Binance said in its Nov. 3 update that it would absorb the attack’s financial impact and that 98% of impacted token assets had been replenished as of Oct. 31.
For investors assessing XRP’s recovery, the traced split puts the origin of large balances ahead of their number.
Rising wallet counts become more informative when they connect to new buying and independently held balances. Here, a transfer of existing stolen tokens is sufficient to explain the creation of six large accounts.
