Two groups of large XRP holders have added 770 million tokens to their combined balances since the Binance hack occurred five days ago.
Specifically, the groups include addresses holding between 1 million and 10 million XRP and those with balances ranging from 100 million to 1 billion XRP.
Large XRP Holders Add 770M Tokens
On Oct. 28, a day before the Binance exchange exploit, these XRP holders had a combined balance of 12.05 billion XRP, worth more than $15.9 billion at the time.
Of this figure, wallets holding 1 million to 10 million XRP had 3.91 billion tokens, while those with 100 million to 1 billion XRP held 8.44 billion tokens.
The cumulative figure has since risen to 12.82 billion XRP, with the holdings now worth more than $16 billion. Notably, addresses with 1 million to 10 million tokens now hold 3.99 billion XRP, with the ones holding 100 million to 1 billion XRP now sitting on 8.83 billion tokens.

The large increase shows that large XRP holders have continued to move significant amounts of the token despite the market’s recent weakness.
Interestingly, both groups had remained mostly inactive throughout October. They occasionally reduced their holdings as XRP faced selling pressure.
However, their activity changed around the time the Binance security breach shook the broader crypto market. While investors reacted to the uncertainty, these large holders began adding substantial amounts of XRP to their balances.
Binance’s $6.3 Billion Breach
For context, the Binance hack had an estimated financial impact of approximately $6.3 billion, which makes it one of the largest security breaches in cryptocurrency history.
The Crypto Basic traced the initial theft to XRP, reporting that hackers drained 233.46 million tokens from Binance within minutes of the incident. The stolen XRP was worth approximately $297 million at the time.
The breach spread fear across the crypto market and triggered widespread selling as investors reacted to the news. Interestingly, large XRP holders began increasing their balances during this period of market uncertainty.
XRP Absorbs the Damage
On the day of the hack, XRP fell 6.64%, recording its steepest single-day decline since mid-September. Its price dropped from $1.32 to $1.23 before the trading session ended.
XRP attempted a small recovery the following day but failed to move above $1.27. The token then traded within a narrow range of $1.24 to $1.26 for the next three sessions as the market continued to assess the impact of the breach.
This period of sideways trading also coincided with most of the accumulation recorded among large XRP holders. Their combined balances increased while XRP struggled to recover from its Oct. 29 decline.
By Nov. 3, XRP had started to recover, gaining 2.09% in one session and climbing back to $1.28. While this increase has brought some relief after several difficult trading sessions, the token remains below its October 29 price of $1.32.
Are Large XRP Holders Accumulating or Just Rebalancing?
There are two possible explanations for the 770 million XRP increase, and the available on-chain data does not establish which one is correct.
The first is that large holders saw the market decline as a buying opportunity and decided to increase their positions while prices remained low.
This follows the buy-the-fear approach, in which investors purchase an asset when negative market sentiment pushes its price down.
Santiment’s previous research has also pointed out that increased activity among large-holder wallets during price declines can indicate growing confidence among investors with longer-term plans. XRP millionaire addresses have also increased during this period.
The second explanation relates to the restrictions Binance introduced after the security breach.
The exchange suspended deposits and withdrawals following the incident, and the large XRP movements visible on-chain suddenly stopped. This suggests that the suspension may have affected the activity recorded during that period.
Once Binance resumed withdrawals, the large XRP movements started again. This raises the possibility that some of the 770 million tokens came from existing holders moving their assets away from Binance into private wallets or other platforms, not necessarily buying additional XRP.

