Binance Hack Splits 233.46 Million XRP Across 7 New Accounts

Seven Accounts Hold the Stolen XRP

Seven newly opened XRP accounts now hold almost the entire 233.46 million XRP stolen from Binance, and on-chain tracing shows the split was completed without any fresh buying. The exchange's own report, published on Tuesday, November 3, scopes the loss to five of its hot wallets, online endpoints it runs for deposits and withdrawals: 233.46 million XRP left those endpoints between 20:05 and 20:09 UTC on Thursday, October 29, landing at addresses under the attacker's control. The theft window closed in about four minutes. The coins then sat still until Monday, November 2, when on-chain forensics by analytics firm Bitquery traced the balance splitting into seven new accounts, a move readable on the public ledger by any blockchain node. Five of those accounts received 40,001,000 XRP apiece, one took 33,455,920 XRP, and the seventh received only 1,000 XRP. All seven were created on November 2, within the same redistribution pass. Each destination is a distinct crypto wallet address, which means most large-holder tallies treat them as separate owners. Whether whale-count dashboards register a gain depends on assumptions the trackers spell out themselves, chiefly whether the original source address was already inside the counted set. The report puts nothing else at risk: it covers the five hot wallets and stops there. The XRP price is not the vehicle of this story, and nothing in the transfer chain describes a market transaction; the event is a custody breach followed by internal redistribution, and its first visible effect lands in holder statistics rather than in spot trading volumes.

Whale Counts Rise Without Buying

The measurable consequence is a whale count that can rise with no accumulation at all. Addresses holding more than 1 million XRP form the standard large-holder tally; if a counter tracks balances above that line, the redistribution replaces one address that was already counted with six that were not, a net gain of five large holders. Bitquery's record makes the premise explicit: the arithmetic assumes the source address was already inside the tally before the split. Either way the direction is clear: existing holdings moved, nothing was bought, and the holder count went up anyway. Figures like this fill XRP whale tracking feeds and are regularly read as accumulation by new large buyers, which is precisely the misread this episode enables. As of Tuesday, November 3, on-chain data showed none of the seven accounts had moved again, leaving the distribution frozen at the split. Binance said it is absorbing the losses itself, so the shortfall lands on the exchange's own balance sheet rather than on depositors, and that by Saturday, October 31, it had reimbursed 98% of the affected token assets. CryptoQuant analyst Amr Taha separately reported that the share of small transfers in XRP exchange outflows climbed from 17% on September 30 to 33.4% on October 29, the day of the theft, a shift in the composition of outflow traffic rather than in its total.

The Trail Ends at Seven Addresses

The reading that matters here: whale counts get quoted as accumulation signals, and a laundering step can manufacture one. Nothing separates the six large accounts from organic holders except provenance, which only transaction-level forensics can establish; provenance, not the holder number, is the load-bearing fact. Wallet-level movements on this chain have produced misleading signals before, from a Yellow Team wallet that sold 20,000 XRP worth of tokens on launch day to XRP Ledger burns jumping 627% in a month. Every hop in this chain, from the five hot wallets to the seven accounts, sits on a public ledger with a fixed timestamp, which is why the distinction is checkable in public data alone. For anyone deciding how to buy XRP this week, the provenance question says more than the holder count does. The bounded picture as of November 3: the funds intact and unmoved across seven accounts, 98% of user losses reimbursed, and no observed movement since. What the sources still leave open is the attacker's next step; until those seven addresses move, the last known position is where the record currently stops.