Binance hack attacker moves 233M XRP into six new wallets after 80 hours of silence

XRP added 7,934 new wallets on Sunday, November 1, 2026, which Santiment ranks as the sixth-largest daily increase of the year, and the analytics firm says the Binance hack may be pushing holders to move their funds. Santiment stops short of proving the link, and new addresses do not necessarily mean new investors.

XRP wallet growth accelerates after Binance hack

The figures published by Santiment show that the increase was particularly significant given the timing. November 1 was a Sunday, traditionally a quieter period for blockchain activity, yet XRP recorded thousands of new addresses.

Santiment stated the development in a November 2 update on X, stating: “$XRP network growth is accelerating fast.”

The analytics company also suggested that the Binance hack could have contributed to the increase by encouraging cryptocurrency holders to explore alternative storage arrangements.

Blockchain addresses do not necessarily represent individual investors. An existing XRP holder who creates several wallets or transfers assets away from an exchange can contribute to the same growth statistics.

Binance hack raises fresh concerns about crypto security

The security incident behind the renewed attention involved the transfer of approximately 233.46 million XRP from five Binance wallets to an address controlled by an attacker on October 29.

Blockchain transaction tracking indicated that the transfers happened within approximately four minutes, with the affected wallets retaining only their minimum balances afterwards.

The Binance hack also created concerns about the availability of customer funds and the exchange’s ability to restore normal operations following the incident.

Binance subsequently announced a recovery programme involving its corporate treasury, the Secure Asset Fund for Users (SAFU) and part of its futures insurance fund.

In its October 31 recovery announcement, the exchange disclosed that it had allocated more than $6.34 billion in company resources to cover the affected assets. It also reported that approximately 90% of the impacted amount had been replenished at that stage.

The exchange further confirmed that XRP and nine other major cryptocurrencies were fully backed by reserves.

Binance stated that it will absorb the financial impact of these stolen funds, not our users. The announcement was particularly relevant to XRP holders because the exchange’s recovery efforts addressed concerns surrounding customer balances and asset backing.

XRP price faces an important technical test

Despite the increase in wallet creation, XRP’s price performance remained relatively subdued during the period covered by Santiment’s analysis.

The cryptocurrency traded around $1.25, suggesting that increased blockchain participation had not yet translated into a significant price breakout.

Santiment identified $1.25 as an important immediate price level, while $1.30 represented the next threshold that could strengthen the bullish outlook.

The analytics firm also highlighted the importance of maintaining consistent wallet growth rather than relying on a single day of unusually high activity.

According to its assessment, sustained daily wallet creation above approximately 4,000 addresses, combined with XRP reclaiming $1.30, would provide a more constructive indication of market momentum.

Conversely, a decline below $1.20 alongside daily wallet creation falling beneath 3,000 addresses could weaken the positive outlook.

It is worth remembering that wallet growth alone cannot establish the direction of future prices. Broader market conditions, liquidity, trading volume and investor sentiment will remain important factors in determining XRP’s performance.

Binance hack aftermath brings self-custody back into focus

Another important development emerged on November 2, when the attacker reportedly transferred the stolen XRP into six newly created wallets.

The movement involved approximately 233.45 million XRP distributed through nine large transactions between 3:52 a.m. and 4:00 a.m. UTC. The transfers followed a period of roughly 80 hours during which the stolen assets had remained largely inactive.

This development adds another layer to the security concerns surrounding the Binance hack, particularly as investors continue monitoring the movement of the affected funds.

Meanwhile, Binance published another recovery update on November 2, confirming that approximately 95% of the impacted assets had been covered.

The exchange also announced that users could independently verify the backing of the ten supported cryptocurrencies through its completed zero-knowledge Proof of Reserves process.

The takeaway from the Binance hack is that security incidents can influence investor behaviour beyond the platform directly affected. XRP’s increase in new wallet addresses provides an example of how concerns about exchange security may coincide with changing custody preferences.

Whether this activity develops into sustained XRP adoption or remains a temporary response to market uncertainty will become clearer through subsequent network data and price movements.