The Binance hacker XRP stash is shrinking fast: on-chain data shows the attacker behind the October 29 Binance theft has offloaded 171.66 million stolen XRP since November 5, leaving about 61.8 million coins in his wallets as of Tuesday morning.
The selling has come as XRP slid from around $1.30 to $1.10. On Tuesday the coin traded near $1.10, with a 24-hour range of $1.075 to $1.116.
Binance Hacker XRP Wallets: What the Ledger Shows
The attacker took 233.46 million XRP as part of a wider theft of crypto assets worth about $6.43 billion from Binance on October 29. In the early hours of November 2 the coins were split across six new wallets on the XRP Ledger, five holding about 40 million XRP each and one holding 33.46 million.
Those wallets stayed silent until November 5. Since then, four of them have emptied into a single collection wallet, which has sent out 929 payments to 94 different addresses. The typical payment is about 144,000 XRP and the largest was 2.02 million. One wallet with 33.46 million XRP has not moved at all.
| Day (UTC) | XRP moved out |
|---|---|
| Thursday, November 5 | 21.89 million |
| Friday, November 6 | 46.22 million |
| Saturday, November 7 | 35.98 million |
| Sunday, November 8 | 15.38 million |
| Monday, November 9 | 46.63 million |
| Tuesday, November 10 (early hours) | 5.54 million |
| Total | 171.66 million |
Where the Stolen XRP Is Going
Blockchain analytics firm Elliptic, which has tracked the loot since the theft, says most of the XRP that left the wallets was swapped into bitcoin through THORChain, a decentralised service that lets users trade coins across blockchains without an exchange account. THORChain paused XRP trading from November 7, which matches the quieter Sunday in the table above. Naming the service does not mean it or its operators had any role in the attack.
The FBI attributed the theft to the TraderTraitor group on October 31, which US authorities link to North Korea, and placed more than 600 addresses on its blocklist. Around 54 percent of the total loot was in stablecoins.
One detail matters for holders: native XRP cannot be frozen. Stablecoin issuers can block flagged addresses, but XRP has no issuer with that power, so only exchanges and swap services can stop the coins when the attacker tries to convert them.
How the Binance Hacker XRP Sell-Off Affects You
- Short-term pressure: Millions of XRP have hit the market every day for five days, in step with the price drop from $1.30 to $1.10.
- The overhang is shrinking: Only 61.8 million XRP remain, and more than half of that sits in a wallet that has not moved.
- Key level: $1.075 was the 24-hour low; traders are watching whether buyers defend it.
- For Pakistani users: Crypto prices stay highly volatile after large hacks. This is news coverage, not investment advice.
What Happens Next
At the pace of recent days, the remaining coins in the collection wallet could be gone within about two days. After that the market loses a steady daily seller, though the untouched 33.46 million XRP wallet remains a risk. Investigators and exchanges continue to track the addresses on the FBI list.
Read More: Binance Hack: Are Pakistani Users Safe After $6.3bn Theft?
Follow the TaazaTaren channel for the latest updates.
