XRP price at $1.28: Binance hacker parks 233 million XRP in six wallets

The XRP price stood at $1.28 on Tuesday evening, November 3, up 3.7 percent on the previous day. Yet a holding that shows up on no price screen hangs over the market: 233.46 million XRP from the Binance hack of October 29, worth around $299 million at the current price. Overnight into Monday, the attacker spread it across six new wallets.

What is established: by Tuesday evening, not one of these six wallets had sent a single payment, as our own query of the XRP Ledger shows. Our assessment follows further down. The holding is a real risk for the price, but it does not justify hasty selling. This article sets out what happened on the ledger, why Ripple cannot freeze the coins, which price levels matter until November 8 and what investors in Germany should sensibly address on custody, leverage and the holding period.

Binance hacker spreads 233 million XRP: the sequence on the XRP Ledger

On the evening of October 29, from 20:05 UTC, 233.46 million XRP flowed out of five Binance wallets to a single attacker address within around four minutes, as Bitcoin.com News reported based on ledger data. The holding then sat untouched for a good 80 hours.

The distribution began overnight into Monday, November 2. From 03:47 UTC, test payments of 1,000 XRP each went to six newly created addresses. Between 03:52 and 04:00 UTC, nine large transfers followed. In the end, five wallets received 40 million XRP each, three of them in two instalments of 30 million and 10 million. The sixth wallet received 33.46 million XRP. Just 23.7 XRP remained on the source address, practically nothing.

A pattern like this is typical of the first phase of money laundering. The attacker uses small amounts to test whether the destination addresses work and splits the loot so that no single account carries the full amount. The US Federal Bureau of Investigation attributes the attack on Binance to the North Korean group TraderTraitor. The addresses the FBI has published are listed in our report on the FBI blocklist after the Binance hack.

Our own XRP Ledger query: all six wallets are holding still

For this article, we queried the source address and the six destination addresses directly on the XRP Ledger on Tuesday evening, in validated ledger 108,094,101. We counted each address's balance and every outgoing payment since the loot arrived. cryptoticker.io compiled this analysis itself on November 3, 2026.

The total matches the reported 233.46 million XRP to the coin. Besides the attacker's transfers, each of the six wallets has recorded only incoming entries and not a single debit. Anyone who wants to follow the trail can find the source address in the public XRPL explorer; from there, the payments lead to all six destinations.

The finding cuts both ways. As long as the coins sit still, they put no pressure on the market. But they remain available at any time, and a single transfer to an exchange or swap service would make the overhang visible.

Why Ripple cannot freeze native XRP

With stablecoins such as Tether, USDC or Ripple's own RLUSD, there is an issuer that can block balances on specific addresses. Ripple froze stolen RLUSD in this way after the Binance hack, Bitcoin.com News reported. Native XRP works differently. A native coin is the base currency of a blockchain itself; no company issues it, and there is nobody who could trigger a freeze function. Ripple does hold large amounts of XRP, but it has no technical access to other people's accounts.

The bottleneck for the attacker therefore lies elsewhere: with the exchanges and swap services. Anyone who wants to turn stolen XRP into money has to deposit it with a provider at some point, and there compliance teams can reject or freeze deposits from flagged addresses. XRP holders know this pattern from September. In the Bitget hack, the attacker moved around 103 million XRP, worth about $83 million, to five accounts, and there too Ripple could block nothing. We explained the background on issuer tokens and native coins in detail in our piece on the limits of freezing stolen coins.

The comparison shows the scale: the current holding is more than twice as large as back then measured in XRP, and three and a half times as large in dollars.

$299 million against $1.6 billion in daily volume: the size of the overhang

At first glance the holding looks small. 233.46 million XRP is just under 0.37 percent of the circulating supply of around 63.35 billion XRP that CoinGecko showed on Tuesday evening. The comparison with trading is more telling: total XRP trading volume over the past 24 hours was around $1.65 billion. The attacker's holding thus equals a good 18 percent of a day's turnover.

A sale of that size in one go would weigh noticeably on the order books. Whether that happens is far from certain, though. With the other parts of the loot, the attacker has so far relied mainly on swap services and bridges between blockchains rather than the large exchanges. According to an estimate by analyst SomaXBT, cited by Cryptopolitan, around $242 million passed through routes linked to Tron within two days, about $140 million of it via Relay and THORChain. According to Bitcoin.com News, the bitcoin portion of the loot has not moved so far.

XRP price since the break of $1.30: what has changed since Friday

On Friday, October 31, XRP traded at $1.247. Before that, on October 29 and 30, the price had fallen from $1.32 to a low of $1.21 and broken through the $1.30 level that had caught every pullback since mid-October. The details are in our analysis of the XRP price below $1.30.

Since then, the price has recovered by just under three percent. On Tuesday it moved between $1.24 and $1.29 according to CoinGecko, but has not yet reclaimed $1.30. New on Tuesday was the ledger amendment fixCleanup3_4_0, which is on course for activation with 33 of 35 validators; what that means technically is covered in our article on the XRP ledger fix.

The data beneath the surface is mixed. According to an analysis by crypto.news, the number of wallets holding 10 million to 100 million XRP recently fell from 351 to 339, while holdings on exchange addresses rose by around 47 million XRP. Both point rather to a willingness among large holders to sell. US spot XRP ETFs recorded a small net outflow of $529,510 on November 2; since launch, inflows total around $1.81 billion. The Coinbase premium, the price mark-up on the US exchange Coinbase against the global market, stood at about minus 0.16 percent, a sign that US buyers are holding back. On the other side is the number of newly created wallets on the XRP Ledger, which on November 1 reached 7,934, the sixth-highest daily figure of the year.

Options market prices an 8.7 percent move by November 8

The derivatives market shows how nervous traders are. According to Coinbase options data reported by U.Today on Tuesday morning, options traders expect XRP to move 8.7 percent in one direction or the other by November 8. For bitcoin the figure is 5.8 percent, for Ethereum 7.7 percent. That puts XRP, alongside Solana, among the coins with the highest expected volatility.

Implied volatility is the range of fluctuation derived from option prices. The figure describes one standard deviation, a band within which the price should stay with a probability of around 68 percent. U.Today calculated a range of roughly $1.14 to $1.36 based on $1.25. From Tuesday evening's level of $1.28, the same calculation gives around $1.17 to $1.39. The options market thus sets no direction, but it does set the size of the move investors should prepare for.

XRP levels: $1.23 and $1.20 below, $1.30 and $1.40 above

Four levels stand out for the coming days. On the downside, the first is the daily low at $1.24, with $1.23 just below it, which analyst Ali Charts names as the line between buyers and sellers; in his reading, a four-hour close below $1.23 would strengthen the sellers. The next support follows at $1.20 to $1.21, where the low of the slump lay on October 30.

On the upside, $1.30 is the decisive hurdle. The level was the floor in October and has turned into resistance since the break. Above it, the next level is $1.40, the area of the interim highs from mid-October. Notably, the upper end of the options range, at around $1.39, sits almost exactly there, while the lower end, at $1.17, lies just below the October low.

Our view: an overhang on a timer, but not a sell signal

In the editorial team's view, the attacker's holding is more likely to accompany the XRP price over weeks than to push it down in a single wave. The evidence: according to our query, the coins sat completely still until Tuesday evening; with the other parts of the loot, the attacker has so far chosen the slow route via swap services; and exchanges can reject deposits from flagged addresses. The options market, moreover, is pricing an 8.7 percent move, not a crash.

Against this, $299 million is just under a fifth of a day's turnover, and large holders are already shifting holdings to exchanges. If the six wallets move, a test of $1.20 is likely. We do not derive a buy or sell recommendation from this. Anyone holding XRP should know $1.23 as a warning level and size their position so that a ten percent pullback remains bearable. A total loss can never be ruled out with crypto assets.

XRP on Binance or in your own wallet: custody after the reopening

Binance reopened XRP withdrawals on November 1 as one of the first currencies and enabled further networks on November 3. According to the exchange, it has replaced around 95 percent of the stolen assets from company funds; some other reports cite 90 percent, and Binance plans to present a final tally with its investigation report. How the freeze came about is covered in our report on the paused Binance withdrawals.

Two practical points follow for XRP holders. First, anyone moving XRP from an exchange to their own wallet needs an activated address on the XRP Ledger with a small minimum reserve that stays locked in the account. On the way back to an exchange, a destination tag is almost always required, a numerical identifier the exchange uses to assign the deposit to your account; without it, the credit depends on customer support. Second, do not accept XRP from unknown senders, for example through over-the-counter deals. If it comes from one of the flagged wallets, the exchange may temporarily freeze your account on deposit, even if you have nothing to do with the theft.

Anyone holding larger amounts for the long term keeps them safest on a hardware wallet whose keys never touch the internet. Which devices support XRP and what they cost is shown in our hardware wallet comparison.

Leverage on XRP: with an 8.7 percent swing, liquidation comes quickly

The expected 8.7 percent swing is above all dangerous for leveraged positions. A liquidation is the forced closure of a leveraged position by the exchange as soon as the posted collateral no longer covers the losses. With ten-times leverage, a counter-move of just under ten percent is enough in arithmetic terms, slightly less depending on the exchange and the maintenance margin, and the capital deployed is gone.

XRP has an added peculiarity. Should the attacker's six wallets move towards an exchange, the news would spread within minutes via services such as Whale Alert. Reports like that often trigger short, sharp downward spikes that close leveraged long positions in droves. Anyone trading with leverage therefore sets the stop at a distance from the known levels of $1.23 and $1.20, where experience shows a particularly large number of orders cluster.

Holding period and exemption limit: the tax side of selling XRP

Anyone who wants to sell out of concern about the overhang should check the purchase date first. In Germany, selling XRP is a private disposal transaction under Section 23 of the Income Tax Act. If more than twelve months pass between purchase and sale, the gain is tax-free. Within that period, gains are taxable if all gains from private disposals in the year together reach €1,000 or more. The exemption limit is not an allowance: anyone who exceeds it pays tax on the entire gain, not just the part above it.

Conversely, losses from XRP sales within the holding period can be offset against gains from other private disposals. A reform of the holding period is under discussion but has not been adopted; our overview of the crypto holding period and its reform tracks the current status. Anyone trading across several exchanges and wallets can most easily keep track of the deadlines with a tax tool that matches purchases automatically.

Buying under MiCA: what matters when adding to XRP

Anyone looking to use the volatility to buy more is best served in Germany by a provider authorised under the European crypto regulation MiCA. MiCA is the EU rulebook for crypto service providers; authorised providers must keep client funds separate from their own assets and are subject to supervision, in Germany by BaFin. Whether a provider is authorised can be checked in the register of the European Securities and Markets Authority, ESMA.

An exchange hack like the one at Binance also shows why it makes sense not to leave your entire balance on a single platform. Which MiCA-authorised exchanges offer XRP and what buying there costs is set out in our overview of regulated crypto exchanges. A savings plan in fixed instalments also takes the question of the right entry point out of the equation when volatility is high.

XRP price: as long as the six wallets stay still, $1.30 is the level that counts

1. Sort out custody: Do not leave long-term XRP holdings on a single exchange, and check the destination tag on every deposit. Suitable devices for self-custody are in our hardware wallet comparison.
2. Choose how you buy: Buy only from MiCA-authorised providers and keep an eye on the $1.23 and $1.30 levels instead of chasing the price. The providers are listed in our overview of regulated crypto exchanges.
3. Document for tax: Note the purchase date and price of each tranche before you sell, so that the holding period and the exemption limit apply. Suitable tools are covered in our comparison of crypto tax tools.

(As of November 3, 2026. This article is not investment advice. Prices and fee structures change; check the terms with the provider before you buy.)