Why Is XRP Down? Lowest Since August as Binance Hacker Starts Moving Coins

The Binance hacker has started cashing out the stolen XRP, and the XRP price is feeling it.

XRP dropped to $1.1627 on Saturday, its lowest price since August 20. It trades at $1.17 at the time of writing, down 10.7% since Wednesday’s close. Bitcoin lost 5.5% over the same days.

So why is XRP down this much more than the rest of the market? Part of it is the whole market. The other part has six wallets and a name on it.

Why Is XRP Down More Than Bitcoin?

Because XRP has a known seller now, and Bitcoin doesn’t.

Thursday’s drop hit everything. Bitcoin slid from about $80,400 to $76,000 between 12:00 and 16:00 UTC (7 a.m. to 11 a.m. in New York), and XRP went with it. Friday is where they split. Bitcoin, Ethereum and Solana all closed the day roughly flat. XRP fell another 2.3%.

Priced in Bitcoin, XRP closed Friday at 0.00001554 BTC, the lowest daily close since August 18.

That gap opened on the same afternoon the stolen XRP started to move.

Partner

Where Is the Binance Hacker’s XRP Going?

Mostly into Bitcoin, through THORChain, a cross-chain swap protocol that needs no account.

Some background. When Binance was hacked on October 29, the attacker took 233.46 million XRP. On November 2, the coins were split across six new wallets, about 40 million each, and then sat still for three days.

That ended at 14:56 UTC on Thursday (9:56 a.m. in New York). We pulled the wallets from the XRP Ledger this morning. One of the six, ryB7NESZ…, has become the hub. Two of the others emptied their 40 million XRP into it, on Friday and early Saturday, and from there the coins go out in small pieces:

• 403 payments since Thursday afternoon, most of them 50,000 to 400,000 XRP.
• 38 receiving wallets; every one we checked was created on Thursday.
• 76.7 million XRP sent out, about $89 million at the time of writing.

By day, it was 21.9 million XRP on Thursday, 46.2 million on Friday and 8.6 million in the first three hours of Saturday. Most of the receiving wallets have already passed it on. Our count matches Elliptic’s: about 42 million XRP had left by Friday morning.

Blockchain analytics firm Elliptic followed the trail to the end. In its running report on the hack, it says the XRP is being swapped “mostly through THORChain into bitcoin”:

Elliptic @elliptic

Binance hack update: the XRP has started moving. About $50 million has been swapped, mostly through THORChain into BTC, with about $226 million still to move.

Bitcoin converted from other stolen assets is now about 1,650 BTC ($124 million), almost twice the figure a day earlier.

11:59 AM · Nov 6, 2026 View on X

In other words, this is XRP being sold. Every swap into Bitcoin is someone on the other side taking XRP off the hacker’s hands, and the pool has to find buyers for it.

SIDE TRAIL: XRP vs Bitcoin: XRP Lags the Rally, and It Isn’t the Escrow

How Much Stolen XRP Is Left?

About 156.7 million XRP, or roughly $183 million at today’s price.

Three of the six wallets haven’t moved yet. They still hold 40 million, 40 million and 33.46 million XRP. The hub wallet holds another 43.3 million, waiting to go out.

So about a third is gone. Two-thirds is still to come.

For context, that is more than half of the 300 million XRP Ripple keeps from its monthly escrow unlock. The difference: Ripple’s share is a routine the market has priced in for almost two years. This one isn’t.

We have seen this pattern before. The same attacker spread 684.6 million stolen TRX over 220 wallets in a few days, and TRX lagged the market while it happened. Elliptic expects the rest of the hack to go the same way: swapped into Bitcoin in many small transactions, then cashed out over months.

Nobody can freeze it, either. XRP has no issuer that can block a wallet, and the FBI has already published the attacker’s addresses. Services are watching, but THORChain doesn’t run identity checks.

Are Traders Buying the XRP Dip?

They are, and that might be the bigger worry.

On OKX, the long/short account ratio for XRP futures rose to 4.34 on Friday, up from 2.71 on Tuesday. That is more than four accounts long for every one short. Bitcoin’s ratio was 3.03.

At the same time, XRP open interest on OKX fell from $132.1 million on Wednesday to $117.1 million on Friday, down 11%. Bigger positions are closing. Smaller accounts keep buying.

That mix is fragile. If XRP slips again, those longs become sellers too.

The Fear & Greed Index sits at 25, extreme fear.

XRP Price Analysis: Where Is the Next Support?

Start with the weekly chart. XRP closed last week at $1.2507, already the lowest weekly close since mid-August. This week is down 6.8% so far. A Sunday close under $1.25 would be the lowest weekly close since the week of August 10, before the summer breakout.

On the daily chart, XRP is below both moving averages. The 200-day sits at $1.27 and the 50-day at $1.38, still falling.

• First ceiling: $1.20. The October 30 low held for a week and broke on Thursday. Broken floors tend to turn into ceilings.
• The 200-day: $1.27. XRP lost it on Thursday. Back above it, and this week was a shakeout.
• First support: $1.14. The 0.786 Fibonacci retracement of the August-to-September rally.
• Below that: $1.09. The August 20 low, the last stop before the range where the breakout started, between $0.99 and $1.05.

TRAIL MAP: Multi-Timeframe Analysis: Top-Down Trading From the Weekly to the Entry

The chart matters less than usual this week. 156.7 million XRP is still sitting in the hacker’s wallets.

Written by

VikingXBT

VikingXBT has been trading crypto since 2017. The focus is futures, onchain data and automation. Onchain flows get checked before a chart is trusted, and anything repetitive gets automated. VikingXBT built Base Camp's own onchain scanner, which flags bundlers, snipers, dev holdings and wallet clusters in one view, and backtests strategies before trading them.

More from VikingXBT