Binance XRP reserves surge 280M tokens in two days after October hack

What happened

Binance's XRP reserves grew substantially in early November, climbing by 280 million tokens over a 48-hour period between November 3 and 5. The exchange's holdings rose from 2.35 billion to 2.63 billion tokens, representing an 11.9% increase, according to The Crypto Basic.

The timing of the inflow directly follows the October 29 security breach, when hackers accessed five of Binance's hot wallets and stole 233.46 million XRP along with other cryptocurrencies. Blockchain intelligence firm TRM Labs attributed the attack to North Korea's TraderTraitor hacking group. In total, the hackers also took 18,270 Bitcoin, 970,500 Solana, and 44.2 million OP tokens, with the incident valued at approximately $6.34 billion, making it the largest cryptocurrency heist on record.

The additional 280 million XRP represented a sharp reversal in the exchange's deposit and withdrawal flows. Large-transfer netflows swung from an outflow of 226 million XRP on the day of the hack to an inflow of 273 million XRP by November 4, according to CryptoQuant data cited by 99Bitcoins.

Why it matters

The reserve restoration has implications for both Binance's operational standing and XRP trading dynamics. Binance assured customers they would not suffer losses from the attack, instead using its own capital to cover the stolen assets through three sources: its Secure Asset Fund for Users, futures insurance reserves, and corporate holdings. The rapid rebuilding of reserves demonstrates the exchange's financial capacity to absorb a major security incident, while also raising questions about market dynamics on the platform. Despite reserves growing, data from CryptoQuant showed that XRP's scarcity index on Binance reached its highest level since 2022 around November 5, suggesting that less supply is immediately available for trading even as total holdings increased. This disconnect between rising reserves and trading scarcity could indicate that newly restored tokens are being held rather than made available for immediate sale.

Background

The October 29 hack forced multiple entities to take action to contain the damage. Binance froze or intercepted approximately $2.85 billion in assets linked to the attack, while industry partners Tether and Circle froze about $3 billion in affected assets. By November 4, Binance had replaced 98% of the affected assets across all cryptocurrencies. XRP was among the fastest to recover, with the exchange confirming 100% reserve backing for XRP by October 31, just two days after the breach. Nine other cryptocurrencies also reached full reserve backing during the same period, including Bitcoin, USDT, RLUSD, Ethereum, Solana, and BNB, as verified through Binance's Proof of Reserves system.

The deposit and withdrawal dynamics on Binance shifted notably in the aftermath. Between October 27 and November 5, Binance's share of XRP deposit transactions across centralized exchanges rose from 44.3% to 56.2%, while its share of withdrawal transactions fell from 55.7% to 43.7%. This shift shows that deposits became a larger share of transaction activity on the platform than withdrawals, reversing the typical pattern. Across the broader centralized exchange market, the change was less pronounced, with XRP deposit share increasing from 45% to 47.5% and withdrawal share declining from 55% to 52.4%.

What is still unclear

A critical question remains unanswered: where did the 280 million XRP tokens that entered Binance's reserves originate? The Crypto Basic noted that the tokens could have come from open-market purchases, over-the-counter deals, or transfers between Binance's internal wallets, but the exchange has not confirmed which explanation applies. The source of the additional XRP remains unknown and could have significant implications for understanding how Binance rebuilt its reserves so quickly following the hack.

What to watch

Observers should monitor Binance's reserve communications for transparency on token sourcing. The exchange reported different asset recovery figures at different times: 90% replenishment on October 31, which increased to 95% on November 2, and later reported 98%. On November 4, Binance also expanded its Proof of Reserves snapshot from 10 verified assets to 44, suggesting ongoing efforts to provide greater transparency. How these newly acquired XRP tokens flow through trading markets and whether they put downward pressure on price will be worth tracking in the coming weeks.

Questions readers ask