The attacker who stole crypto assets worth $6.43 billion from Binance on October 29 had cut his XRP holdings by more than three quarters by Tuesday morning. Of the 233.46 million stolen XRP, only 61.8 million were still sitting in his six wallets on the XRP Ledger at 7:49 a.m. German time on Tuesday. That is the result of a query cryptoticker.io ran directly against the ledger. Since November 5, 171.66 million XRP have left the wallets, 46.6 million of them on Monday alone.
For the short-term outlook, this cuts both ways. The selling pressure from the loot was real over the past few days, and it coincides with the slide from $1.30 to $1.10. At the same time, what is left keeps getting smaller. If the pace of recent days holds, the holdings would be gone in about two days. After that, the market loses a seller that has pushed millions of XRP onto it every day for the past five days.
Where the price could head over a horizon of months is covered by our XRP price prediction with its long-term scenarios. This piece sticks to the coming days. On Tuesday morning XRP trades at $1.10, or €0.98, on the Kraken exchange. The range over the past 24 hours runs from $1.075 to $1.116.
Binance hack of October 29: where the 233 million XRP came from
The theft at Binance took place on the evening of October 29 between 20:05 and 23:56 UTC, according to the analytics firm Elliptic, which has been tracking the outflow of the loot ever since. Around 54 percent of the total was in stablecoins. On the evening of October 31 the FBI attributed the attack to the TraderTraitor group, which US authorities link to North Korea. The agency put more than 600 addresses on its list, as our report on the FBI blocklist sets out.
The loot included 233.46 million XRP. On the evening of October 29 the coins moved from exchange wallets to an address controlled by the attacker within a few minutes. In the night to November 2 he split them across six newly created wallets, five of them holding about 40 million XRP each and the sixth 33.46 million. As of November 3 none of these wallets had sent a single payment, as our article of November 3 showed with a ledger query. XRP stood at $1.28 at the time.
One point matters for XRP holders: Ripple cannot freeze native XRP. A native coin is the base currency of a blockchain itself. No company issues it, so it has no freeze function. With stablecoins such as USDC or RLUSD, the issuer blocks flagged addresses. With XRP, that leaves only the exchanges and swap services where the loot is converted into other assets.
XRP Ledger on Tuesday morning: the attacker still holds 61.8 million XRP
For this article cryptoticker.io queried the source address and all six destination addresses on the XRP Ledger at around 7:50 a.m. German time on Tuesday, in validated ledger 108,234,038. The picture has changed fundamentally since November 3.
| ryB7NE…ktmx (collection wallet) | 40,001,000 XRP | 28,348,679 XRP |
| raoMrx…tebm5t | 33,455,920 XRP | 33,455,920 XRP |
| rhfA8Q…c9XB | 40,001,000 XRP | 6 XRP |
| rKxwzj…DH1F | 40,001,000 XRP | 11 XRP |
| rsNoNk…seisW | 40,001,000 XRP | 6 XRP |
| rhXtRt…cuxNRD | 40,001,000 XRP | 5 XRP |
| Total | 233,460,920 XRP | 61,804,627 XRP |
The sequence is easy to follow on the ledger. Four of the six wallets passed on their roughly 40 million XRP each in a single transfer to the wallet ryB7NE…ktmx, the last one at 17:18 UTC on Monday. From this collection wallet the coins go out in small tranches: 929 payments to 94 different addresses, with a median payment of about 144,000 XRP and a largest of 2.02 million. Only one wallet, holding 33.46 million XRP, had not sent a single payment by Tuesday morning.
Where the coins go after that cannot be settled from the ledger alone. Elliptic writes that most of the XRP that left was swapped into bitcoin via THORChain. THORChain is a decentralised swap service that lets users trade coins from different blockchains against each other without an exchange account. Naming the service does not mean that it or its operators were involved in the attack.
The Binance theft of October 29 is the origin of the XRP holdings that have been flowing out since November 5.Daily outflows: Monday was the heaviest day at 46.6 million XRP
Counting the outgoing payments of the collection wallet by calendar day in UTC produces a clear pattern. The first payment went out at 14:56 UTC on November 5, the latest so far at 5:27 UTC on Tuesday.
Thursday, November 5: 21.89 million XRPFriday, November 6: 46.22 million XRPSaturday, November 7: 35.98 million XRPSunday, November 8: 15.38 million XRPMonday, November 9: 46.63 million XRPTuesday, November 10, until 5:27 UTC: 5.54 million XRPThe weak Sunday fits an interruption Elliptic describes: THORChain halted XRP trading from November 7, and for almost a full day no coins left through this route. From the afternoon of November 8, according to Elliptic, the swaps resumed despite the halt. On Monday the outflow hit its highest level so far at 46.63 million XRP, equivalent to about $51 million.
Elliptic had put the remaining holdings at about 95 million XRP at 13:15 UTC on Monday. Our Tuesday morning reading is around 33 million lower. The difference matches what has flowed out since Monday afternoon.
Selling pressure in numbers: what 172 million XRP amount to in the market
A comparison with trading volume helps put the pressure in context. According to CoinGecko, XRP worth about $2.15 billion changed hands worldwide in the 24 hours to Tuesday morning, or just under 2 billion coins. Monday's 46.6 million XRP account for a little over 2 percent of that. On Kraken, 30.5 million XRP traded in the XRP/USD pair on Monday, less than the attacker moved out that day.
A term worth knowing here: traders call a holding that is known to be up for sale an overhang. It weighs on the price before it even reaches the market, because buyers hold back. The overhang from the Binance hack is especially visible because every movement on the ledger is public and services such as Whale Alert report it within minutes.
Measured against a circulating supply of 63.52 billion XRP, the 171.66 million that have flowed out are only 0.27 percent, and the remaining 61.8 million just 0.10 percent. The effect therefore lies less in the amount itself than in its persistence. A seller who offloads between 15 and 47 million coins every day, regardless of price, puts noticeable pressure on prices in a market without strong buyers.
Since Monday's XRP price prediction: $1.08 held only at the daily close
In Monday's prediction XRP stood at around $1.09, and the decisive level was $1.08. The outcome is mixed. During the day XRP fell as low as $1.075 on Kraken, briefly below the level. The daily close of $1.0976 was back above it, however, and since midnight the price has moved between $1.0885 and $1.104. The level has been dented but not broken.
What is new since Monday is the view of the attacker. On Monday the prediction still assumed that demand was the main thing missing, from the US and from Korea. The ledger data show that a large seller was active at the same time. The decline started on November 5: that day XRP fell from $1.304 to $1.206 on Kraken, and the first payments left the collection wallet the same afternoon. Since the open on November 5, XRP has lost 15.6 percent. A link in time is no proof that the attacker caused the decline on his own; the whole crypto market was weak that week.
Once the attacker's holdings are gone, demand will again decide which way XRP goes.US consumer prices and spot ETFs: the second pressure point for XRP
Besides the attacker, two factors hang over Tuesday. At 14:30 German time the US Department of Labor publishes consumer prices for October. There will be no official annual rate, because no index was ever compiled for October 2025, as our report on the bitcoin price on Tuesday morning explains. Economists expect a rise of about 0.3 percent on the previous month. Trading is usually most volatile in the minutes after the release, and XRP typically follows bitcoin.
The second factor is demand from the US. According to Bitcoin.com News, the spot XRP ETFs did not record a single day of inflows in the week from November 2 to 6. The only movement was an outflow of $529,500 from Canary's XRPC fund on November 2. Assets under management fell to $1.34 billion by Friday, mainly because of the price decline. Since launch the funds have taken in $1.81 billion net. That leaves exactly the buyer missing that would have absorbed the attacker's overhang in earlier weeks.
Our view: the overhang is shrinking, but buyers are still missing
In the newsroom's view, the run-down of the loot is the most important new information of the week, and it has a friendlier side than the price suggests. An overhang that gets smaller weighs less. At an average pace of a little over 34 million XRP a day since November 5, the remaining 61.8 million would be gone in about two days if the attacker carries on in the same way. That would remove a seller that has contributed up to 2 percent of global volume each day.
The case against: the one wallet holding 33.46 million XRP has not moved yet, and nobody can say whether or when it will follow. And the end of a seller does not create a buyer. As long as the spot ETFs take in no money and bitcoin is under pressure, the trigger for a recovery is missing. A day of ETF inflows, or an empty remaining balance without a fresh price drop, would turn our assessment positive. This is not a recommendation to buy or sell.
XRP scenarios to the end of November: $1.04, $1.13 and $1.27
The levels are derived from daily candles on Kraken. Each scenario describes a condition, not a forecast.
Weak: If XRP closes a day below $1.075, Monday's low, last week's level has fallen as well. That brings the range between $0.985 and $1.04 into reach, where XRP traded from August 10 to 18. This becomes more likely if the dormant wallet holding 33.46 million XRP starts to move.Sideways: If the zone between $1.075 and $1.125, Monday's high, holds, the market absorbs the rest of the loot without a new low. That would be a first sign that the selling is being absorbed.Recovery: A daily close above $1.13 brings the $1.17 level back into view, where the daily high sat on November 8. The 200-day average, the mean closing price of the past 200 days, is at $1.27, a good 15 percent above the current price.The timing of the scenarios depends on the ledger. Once the collection wallet is empty and the last wallet has not moved, the past week's most important seller drops out. Anyone who wants to follow the movements can find the collection wallet in the public XRP Ledger explorer.
Holding XRP in Germany: holding period, custody and a regulated exchange
For investors in Germany, the run-down of the loot does not change the basic rules, but it makes two of them more pressing. First, tax: gains on XRP are tax-free if more than one year passes between purchase and sale. For shorter holding periods your personal income tax rate applies as soon as all private disposal gains for the year reach €1,000 in total. If you sell now to limit losses, you can offset them against gains from the same year. Our overview of the holding period reform sums up where the debate stands.
Second, custody. The Binance hack has shown that even large exchanges become targets. If you hold XRP for the long term, you do not leave your entire position on a single exchange. A hardware wallet keeps the private keys offline. When you deposit to an exchange, every XRP transfer needs the correct destination tag, a number the exchange uses to assign the payment to your account.
Third, the trading venue. The EU's MiCA crypto regulation has applied since December 30, 2024, and providers in the EU need a licence as a crypto-asset service provider. A euro pair saves the detour via stablecoins, and a limit order protects you against poor fills in volatile minutes such as those after the US consumer price data. Which providers hold a licence is shown in our comparison of regulated crypto exchanges.
XRP overhang: at 34 million a day, the rest lasts two days
The attacker's holdings have shrunk from 233 million to 62 million XRP. The end of the week's biggest seller is getting closer, but demand still has to return afterwards. For the coming days, that means:
Watch the $1.075 level: a daily close below it opens the way to the August range. If you buy more, use a euro pair at a low-fee crypto exchange and place a limit order instead of a market order.Secure your holdings: spread larger XRP positions across several custody locations and check the destination tag on every deposit. Our hardware wallet comparison gives an overview of devices for self-custody.Record the purchase date: every single purchase counts for the holding period. A crypto tax tool records purchase dates and losses in case you want to sell positions.(As of November 10, 2026. This article is not investment advice. Prices and fee structures change; check the terms with the provider before you buy.)
Bengali (Bangladesh) · 
English (United States) ·