The Crypto Basic

XRP has fallen by more than 25% over the past four months, but its millionaire addresses, representing the largest holders, have continued to buy. 

On-chain data shows that addresses holding at least 1 million XRP have added nearly $1 billion worth of XRP since April 2026. This shows a massive difference between XRP’s price performance and the actions of its biggest holders.

XRP Millionaire Addresses Taking Advantage of Lower Prices

According to recent data from Santiment, a market intelligence resource, addresses holding at least 1 million XRP now have a combined balance of 50.24 billion XRP. 

This represents more than 80% of XRP’s 62.67 billion circulating supply, meaning these large holders control a significant portion of the tokens currently in circulation.

Addresses holding at least 1 billion XRP have the largest share of the 50.24 billion XRP held by millionaire addresses. This group holds 26.07 billion XRP, which accounts for 51.9% of the combined balance across the four groups.

The 10 million to 100 million XRP group comes next, with 12.11 billion XRP. Addresses holding between 100 million and 1 billion XRP have 8.2 billion XRP, while those holding between 1 million and 10 million XRP have 3.86 billion XRP, giving them the smallest balance among the four groups.

Data also shows how much these holders have accumulated in recent months. On April 12, 2026, addresses with at least 1 million XRP held a combined 49.27 billion XRP. Their balance has since climbed to 50.24 billion XRP, meaning they have added 970 million XRP in about four months. At current prices, those tokens are worth nearly $1 billion.

10M-100M XRP Addresses Lead the Accumulation Trend

The 10 million to 100 million XRP group accounts for most of the increase. Its holdings rose from 11.38 billion XRP in mid-April to 12.11 billion XRP today. That means this group added 730 million XRP over the four-month period, making up about 75% of the total increase from millionaire wallets.

Addresses holding at least 1 billion XRP also increased their holdings. Specifically, their balance went from 25.84 billion XRP in April to 26.07 billion XRP now, representing an increase of 230 million XRP. 

At the same time, addresses holding between 1 million and 10 million XRP added about 140 million XRP, while the 100 million to 1 billion XRP group reduced their balance by 110 million XRP.

XRP Down 25% Since Mid-April

This accumulation has taken place even as XRP has struggled in the market. Notably, XRP opened at $1.35 on April 12, 2026, but fell by 2.22% that day. The token later recovered and reached $1.54 on May 14. 

However, the recovery did not last, and XRP began falling again until it reached $1.0499 on June 6, 2026, setting a new yearly low at the time.

XRP then rebounded to $1.29, but this level became resistance. The token subsequently fell again, reaching a new yearly low of $1.008 on June 26, 2026. Another recovery followed, but it also failed to hold, with the latest decline taking XRP to around $1.01.

As a result, XRP has now lost more than 25% from its price four months ago. During that same period, however, addresses holding at least 1 million XRP increased their combined holdings by 970 million XRP, worth nearly $1 billion.

The biggest holders of XRP are increasing their holdings even as its market value has fallen massively since last year.

According to crypto analytics platform Santiment, wallets holding at least 1 million XRP increased by 32 over the past three months. This happened while XRP’s market capitalization fell by about 29%.

Specifically, the number of wallets holding 1 million or more XRP has risen from around 2,006 to 2,038. This figure suggests that large investors are becoming more confident in XRP amid the declining prices.

XRP Whales Keep Buying Despite Price Drop

Notably, XRP is now trading around $1.01, down from the $1.40–$1.50 range where it traded three months ago. At the same time, the number of wallets holding at least 1 million XRP has continued to rise.

Santiment says this suggests that some large investors have continued buying XRP instead of selling during the downturn.

While this does not guarantee a recovery in XRP’s price, the rising number of large wallets shows that major XRP holders have not been selling in large numbers despite the recent price decline.

XRP’s Institutional Growth Continues

The increase in large XRP holders comes as the XRP Ledger expands beyond its original focus on payments.

Santiment highlighted RLUSD, Ripple’s dollar-backed stablecoin, as an important institutional product. Ripple is also building payment, custody, and tokenization services on the XRP Ledger.

Ripple has recently invested in ZILO and Licuido to support regulated funds and improve the use of assets on the XRP Ledger. Messari has also noted the network’s growing use for tokenized real-world assets, stablecoins, and institutional finance.

What Could XRP Whale Growth Mean?

The rise in wallets holding 1 million or more XRP, despite the drop in market value, could mean that large investors are buying during the downturn.

If this trend continues, it could support the case for an XRP price recovery. For context, XRP is down more than 73% from its $3.66 peak, which it hit in July 2025. The price briefly fell to $0.9916 yesterday, marking its first time below $1 since 2024.

Despite the major price drawdown, the recent data suggests that whales are focusing on the long term rather than short-term price changes. For XRP supporters, this could be a positive sign.

On-Chain Activity Surges as Exchange Flows Collapse

On August 5, XRP processed more than 2.8 million transactions—an 86% weekly increase and more than 81% above its 30-day average. Active accounts also rose by more than 5% over the past 30 days, signaling stronger network usage.

Meanwhile, exchange activity has fallen sharply. Binance deposit addresses dropped about 96% compared with their monthly and quarterly averages, while XRP deposits and withdrawals fell 79% and 85%, respectively, from their 90-day averages. This suggests that recent price weakness may not be driven by heavy selling into exchanges.

Leverage is also cooling. Open interest fell from $403 million on July 28 to $391 million on August 8, while the leverage ratio declined from 0.190 to 0.150. About $3.4 million in long positions were liquidated on August 7 as XRP briefly approached $1.02.

Market watchers note that rising network activity, declining exchange flows, and reduced leverage point to a potential local bottom.

XRP network activity is improving, even though its price remains near the bottom of its six-month range.

CryptoOnchain, a CryptoQuant author, said XRP closed at $1.039 on August 8. The price fell from around $1.08 to the $1.02–$1.03 range over the past week.

While XRP’s price remains weak, on-chain data shows more people are using the network and selling pressure on major exchanges is starting to ease.

XRP Transactions Jump 86% in One Week

On August 5, XRP processed more than 2.8 million transactions. That’s an 86% increase from the previous week and more than 81% higher than its 30-day average.

Daily transactions stayed high throughout the week, ranging from 1.3 million to 2.8 million. As a result, XRP’s seven-day average rose well above its six-month average of 1.83 million transactions.

The number of active accounts also grew by more than 5% over the past 30 days, showing that more people are using the XRP Ledger.

XRP Exchange Activity Falls Sharply

At the same time, XRP activity on major exchanges has dropped significantly. CryptoOnchain said Binance deposit addresses fell by about 96% compared with their monthly and quarterly averages. XRP deposits and withdrawals on Binance also dropped by 79% and 85%, respectively, compared with their 90-day averages.

This could be a positive sign. XRP’s network is becoming more active, while fewer coins are moving through exchanges. This suggests that the recent price weakness may not be due to large amounts of XRP moving into exchanges for sale.

Leverage Is Cooling

XRP’s derivatives market is also showing less speculation. Open interest fell from about $403 million on July 28 to $391 million on August 8, moving closer to its six-month low. The leverage ratio also dropped from 0.190 to 0.150.

On August 7, about $3.4 million in long positions were liquidated as XRP briefly fell toward $1.02. Funding rates then turned positive again, reaching +0.008 on August 8.

According to CryptoOnchain, this suggests that some risky leveraged positions were cleared out without causing widespread panic or a large increase in short positions.

XRP Could Be Building a Local Bottom

Overall, the data gives XRP a more positive outlook despite its weak price. XRP is trading near the bottom of its six-month range, while leverage and exchange activity have fallen. At the same time, activity on the XRP network has increased.

CryptoOnchain called this a “classic bottom-building signature”. The idea is that more people are using XRP while fewer coins are moving through exchanges, which could mean some investors are quietly accumulating XRP instead of selling.

However, this does not mean XRP will rise immediately. The price could still fall under $1 as bears continue to dominate.

The Coreum XRPL Bridge recently suffered a 200,000 XRP exploit after an attacker exploited a flaw in its deposit verification process.

The Coreum Bridge suffered an exploit on Aug. 9 that led to the loss of nearly 200,000 XRP. However, an analysis by XRPL-based analytics platform xrpl.to shows that the XRP Ledger was not responsible for the loss despite an earlier report suggesting so.

Notably, the bridge account held about 200,410 XRP before the incident. At 19:16 UTC, it began sending XRP to two newly created wallets. Over the next 97 minutes, the account made 94 XRP payments totaling 199,916.3 XRP, leaving just 493.5 XRP. 

The two wallets had been created less than two hours before the first payment and later moved most of the XRP they received to other addresses.

The XRP Ledger Was Not Responsible

The transaction records show that the bridge itself sent every XRP payment. This is because each transaction listed the bridge account as the sender and carried 17 signatures from its 28 relayer keys. 

Since the bridge’s master key was disabled, its 17-of-28 multisig setup provided the only way to approve these transactions.

This goes against an earlier explanation that blamed the XRP Ledger’s DefaultRipple setting. For context, native XRP does not use trust lines and cannot be involved in rippling. DefaultRipple applies to issued tokens, not native XRP, meaning the setting could not have caused the XRP to leave the bridge account.

The transactions also did not use the tfPartialPayment flag. Every XRP that left the bridge came through a payment that its own multisig approved. In other words, the XRP did not simply leak from the account because of an XRPL setting. The bridge authorized the transfers itself.

The Problem Started on Coreum

The evidence instead reveals a flaw in how the bridge checked deposits on Coreum. Notably, the bridge uses relayers to monitor the XRP Ledger and report deposits to its Coreum smart contract. 

When enough relayers submit the same evidence, the contract accepts the deposit and issues the corresponding wrapped assets.

The problem was that the relayer code did not properly check where a payment went. It looked for successful payments in the bridge account’s transaction history that included a Coreum recipient memo, but it did not require the payment to have actually gone to the bridge.

This allowed the attacker to make payments between their own wallets look like deposits. The attacker first moved the bridge’s own wrapped-CORE token between two wallets under their control. 

Although the transaction never sent funds to the bridge, it still appeared in the bridge’s transaction history because the bridge issued the token. Twenty-one relayers then treated the transaction as a valid deposit and reported it to the Coreum contract.

The Attacker Tested the Flaw Before Draining the Bridge

The attacker first tested the system with a 100-unit transfer of the wrapped-CORE token. They then repeated the process with larger amounts, and followed a pattern that roughly doubled the amount at each step.

The exploit eventually created about 4,356,812 CORE and 200,001 XRP worth of bridge tokens without genuine deposits supporting them. After this, the attacker then used those newly created balances to withdraw real XRP from the bridge.

The first XRP payment involved 3,249 XRP. The bridge then sent a much larger 25,908.6 XRP payment before settling into a pattern of transfers of about 1,694.7 XRP to the two attacker-controlled wallets.

The pattern reveals a flaw in the bridge’s code, not a theft of private keys. Twenty-one relayers accepted the first false deposit because they all followed the same verification process. The attacker therefore exploited a weakness in the shared logic that the relayers used to determine whether a deposit was genuine.

The two wallets received about 107,397.5 XRP and 92,518.8 XRP, respectively. They later moved most of the funds to other addresses in transfers of roughly 9,600 to 9,720 XRP. Large portions went to two accounts created on June 28, 2026.

At the time of this report, Coreum had not published a post-mortem identifying the attacker or saying whether any relayer operator had acted beyond negligence.