XRP▲$1.25 saw an impressive increase of 7,934 new wallets on November 1, marking the sixth-highest daily total for the network in 2026. This uptick followed the notable Binance security breach on October 29, during which hackers made off with around 233 million XRP. Meanwhile, US demand indicators appeared to be weakening as the token traded at $1.25.
This increase could indicate that holders are transferring XRP into self-custody wallets, despite a cooling sentiment and a decline in spot XRP ETF inflows. The future trajectory of the token will depend on whether this wallet growth can be sustained and if more buyers re-enter the market around critical price levels.
Contents
What Happened: Surge in XRP Wallets After the Binance Hack
According to Santiment, on November 1, there were 7,934 new XRP Ledger wallets created, exceeding the autumn daily average of 3,500. Notably, this spike occurred on a Sunday when blockchain activity typically experiences a lull.
The Binance attack targeted its hot wallets and affected assets valued at $6.36 billion on the platform. Approximately $297 million worth of XRP was part of the stolen assets. This incident impacted custody operations across different assets, but the subsequent surge in address creation specifically affected the XRP Ledger.
U.Today attributed this rise to users moving XRP from centralized exchanges into newly established self-custody wallets following the incident, suggesting investors preferred to take direct ownership of their assets instead of liquidating them.
Some holders opted to move XRP into secure cold wallets, thereby retaining control over their private keys while diversifying their coins through various new addresses. However, Santiment offered a more cautious perspective, suggesting that the hack could have prompted users to create self-custody wallets. The firm also acknowledged that address growth near the current price level indicates enhanced usage despite ongoing price pressures.
It is essential to note that a new address does not necessarily signify a purchase of additional XRP; a holder may create a new address simply by redistributing their existing coins. These transactions signify a custody shift following the breach, although it remains unclear if buyers are expanding their holdings, a question better evaluated through trading and fund-flow data.
Tracing the Binance XRP Transfers
TRM Labs tracked 233.46 million XRP being transferred from five Binance wallets to an address controlled by the attackers, while Elliptic identified similar transfers totaling about 233 million XRP. The FBI has linked the perpetrators to North Korea’s TraderTraitor group.
US President Donald Trump expressed intentions to investigate the matter, stating he would discuss North Korea’s involvement if confirmed. His comments made any diplomatic discussions dependent on verification. There is no specified timeline for such talks or any follow-up announcements provided.
Binance’s XRP Withdrawals Increased Post-Suspension
CryptoQuant noted significant outflows of 283 million XRP during large transfers from Binance on October 29, coinciding with the breach. Following the suspension of withdrawals, transfers exceeding 1 million XRP plummeted to 14.7 million on October 30, marking a 94.8% decline.
Beginning November 1, Binance gradually resumed withdrawals, including those for XRP. Following this, large transfer outflows surged to 80 million XRP, which is 5.44 times the figure recorded on October 30. However, the whale netflow remained negative, around 50 million XRP. CryptoPotato noted a negative whale netflow of 226 million XRP on October 29, in contrast to -83 million in September 2022.
The whale netflow reading for October 29 was 2.72 times greater than the figure from September 2022. These outflows track XRP exiting the monitored transaction category; negative netflows represent the balance of these movements. Neither statistic contributes to the total amount of XRP that can be traced to the attackers.
CryptoQuant suggested that increased withdrawals might reduce the XRP available for quick sale, potentially alleviating immediate selling pressure. However, these outflows only indicate that coins have departed Binance, not the intentions of their holders regarding retention.
Binance reported it had compensated around 95% of the stolen assets and would absorb customer losses. They indicated that recovering the remaining stolen amount could extend over time, but did not specify a completion date.
XRP Price Faces Divergence Between Wallet Growth and US Demand
XRP was trading at $1.25, reflecting a 0.51% increase over the previous 24 hours, as per CoinGecko. Following the hack, the price dropped from above $1.30 down to $1.20 before showing signs of recovery.
As of November 3, 2026, at 10:04:41 UTC, CoinGecko ranked XRP fifth by market capitalization, with a total market value of $79,499,014,638 and a 24-hour trading volume of $1,312,744,446. The fully diluted valuation stood at $125,471,279,679.
The daily increase occurred against a backdrop of overall market weakness. Reports earlier on November 3 indicated that XRP experienced a nearly 16% decline for the month and a drop of 4.43% over the past week. Another price snapshot showed a slight 0.65% fall. Despite discrepancies in these snapshots, both longer periods indicate losses.
US demand indicators remained subdued, with Arab Chain placing the Coinbase Premium Index at around -0.16%, marking an eight-month low and implying XRP was trading at a lower price on Coinbase compared to Binance. BeInCrypto noted the uptick in wallet activity amid weakened demand on Coinbase and through ETFs.
Arab Chain warned that the dip in premium does not inherently signal further price declines. Ongoing negative readings have occasionally coincided with “weaker purchasing demand on Coinbase,” the analyst remarked, while a return to positive figures might reflect a relative improvement in demand. Given that Coinbase attracts both retail and institutional traders in the US, this comparison is significant to regional demand.
During October, spot XRP ETFs accumulated $18.83 million in net inflows, their lowest amount since January, compared to $121.40 million in September—indicating an 84% drop month over month. Yet, these funds did gain $8.43 million on October 29, subsequently losing $496,000 on October 30.
The latter portion of the month saw influxes that assisted in reaching October’s total; the final two weeks brought in $4.25 million and $4.32 million, effectively counterbalancing modest earlier withdrawals during the month. Hence, the decline in monthly inflows occurred alongside a late-month recovery rather than an uninterrupted trend of outflows.
Fund movements diverged across assets immediately after the hack. US spot Bitcoin ETFs experienced a significant outflow of $643 million on October 30, considerably more than the losses seen in XRP funds that same day. Despite the XRP funds experiencing a lower overall monthly intake, this did not lead to an equally substantial exit from those funds post-incident.
Previous XRP Activity Highlights Demand Changes
Prior trading statistics offer a contrast; busy trading venues did not guard against price declines. A report from CryptoRank on September 5 highlighted that XRP spot volume peaked in August, reaching its highest point since February. During that month, Binance accounted for around $7.28 billion in trading, with Upbit contributing approximately $4.68 billion. Binance had already established itself as a leading XRP trading platform before the October custody incident.
The same September report detailed a price drop following the release of US employment data revealing 162,000 new jobs alongside a 4.1% unemployment rate. In that day’s snapshot, XRP fell by 2.83% to $1.41 while Bitcoin saw a decrease of 1.63%. This scenario illustrates that economic data, rather than an exchange breach, was responsible for those earlier declines amid active trading.
Institutional interest appeared stronger during the previous coverage, with weekly US spot XRP ETF inflows reported at $130 million, leading to total net inflows of roughly $1.68 billion. Although the discussed figures span different periods, they reveal that the funds managed to attract significant subscriptions prior to October’s downturn.
Furthermore, the XRP Ledger was exploring new functionalities, such as implementing a Lending Protocol and Single Asset Vaults, which could serve as enhancements for lending and various financial activities. However, the reports from November did not provide later launch dates or user adoption figures that connected these developments to the post-hack wallet increase.
Key Price Levels and Wallet Growth Scenarios for XRP
Crucial near-term support lies at $1.20, with resistance at $1.30. Santiment’s more favorable scenario suggests that XRP could surpass $1.30 while maintaining wallet growth above roughly 4,000 new wallets each day. Conversely, if growth dips below 3,000 and the price falls below $1.20, that outlook may weaken.
At the current trading price of $1.25, XRP finds itself in a position between these two levels. Santiment’s scenario relies on simultaneous movements in price and network activity. A sustained increase in wallet creation beyond the one-time Sunday surge would provide additional evidence of a lasting shift; any price recovery could signal that trading demand is indeed strengthening.
Santiment asserts that if market sentiment remains below 1.0 while the prices stop hitting new lows, the likelihood of a relief rally increases. Their analysis shows XRP at roughly 0.61 bullish comments for every bearish comment, compared to 0.69 for Bitcoin and 1.14 for Ethereum. Caution is advised, however, as fear alone does not indicate a market bottom.
Sentiments had been on a downward trend for almost two months, with the Binance incident hastening this decline. Santiment’s perspective frames its outlook for both Bitcoin and XRP: “If BTC▼$76,969.00 and XRP sentiment remains beneath 1.0 while prices stabilize,” traders should anticipate a “potential mid-term relief rally.” This context indicates broader conditions rather than pinpointing a specific rebound date.
Potential Risks and Key Indicators for XRP
The increase in new addresses may indicate self-custody activities rather than fresh investors, meaning the wallet count alone does not serve as a signal for price action. Price movements, daily wallet creation rates, November ETF flows, and the Coinbase premium will all indicate whether US demand is improving; the noted thresholds should be viewed as possible conditions rather than guarantees.
Binance still needs to retrieve the remaining assets it has not yet covered after slowly reinstating withdrawals. Future daily updates will reveal if November 1 represented a sustainable change in wallet creation patterns or a focused reaction to the security breach. Binance has not provided a timeline for when they expect to secure the outstanding assets.
FAQ
When did XRP wallet growth accelerate?
Santiment noted an increase of 7,934 new wallets on Sunday, November 1, following the Binance breach on October 29.
How much XRP was traced to the attackers?
TRM Labs tracked 233.46 million XRP being transferred from five Binance wallets to an attacker-controlled address, while Elliptic reported related transfers totaling approximately 233 million XRP.
Which XRP price levels are important in this setup?
The analysis identifies $1.20 as a support level and $1.30 as a resistance level. Santiment’s optimistic scenario suggests that a rise above $1.30 would need to coincide with daily wallet growth surpassing roughly 4,000.
What does a negative Coinbase Premium Index mean for XRP?
A negative index indicates that XRP is trading at lower prices on Coinbase than on Binance. Arab Chain has suggested an index around -0.16%, which represents an eight-month low.
How much did XRP ETFs receive in October?
In October, spot XRP ETFs registered $18.83 million in net inflows, a significant decrease from $121.40 million in September, marking the smallest monthly total since January.
How did Binance XRP outflows change after withdrawals resumed?
Large transfer outflows increased to 80 million XRP on November 1, following the phased resumption of withdrawals, representing a significant rise from the 14.7 million XRP recorded during the suspension on October 30.
How much of the stolen XRP did Binance say it had covered?
Binance reported it covered approximately 95% of the assets stolen and pledged to absorb customer losses, though no date was given for when the remaining assets would be recovered.
This article is for informational purposes only and does not constitute financial advice.