Santiment Links Surge in XRP Wallets to Binance Hack

On November 2, Santiment reported that 7,934 new XRP wallets were created the day before. This is the sixth-largest daily figure in 2026. In a post on X, the analytics company noted unusually high activity on Sunday when the cryptocurrency was trading near the $1.25 mark.

Santiment stated that the growth of the XRP network is rapidly accelerating and linked the moment to the aftermath of the Binance hack, though it was cautious about the potential connection. According to the company, the surge followed a busy week for XRP and occurred right after the Binance hack, which may have prompted more users to self-custody their assets and create new wallets. However, the number of wallets reflects the number of new addresses, not the number of unique users joining the network.

The shift to self-custody means that control over private keys remains with the owners, not the exchange. This distinction underlies Santiment's suggestion that the hack might have prompted users to take such a step. Creating a separate wallet can reflect both a change in storage conditions and the onboarding of a new user.

What happened with XRP

The security incident directly affected XRP. Investigators found that on October 29, five Binance wallets transferred 233.46 million XRP to an address controlled by the attacker in about four minutes. According to transaction tracking, only a minimal balance remained on each sending wallet.

Subsequently, customer support became a central element of the measures taken by the exchange. On October 31, Binance stated that XRP and nine other cryptocurrencies were fully backed, as the company replaced the stolen assets using its own resources. This assurance concerned the reserves backing client balances, which is a separate issue from clients' ability to withdraw funds during the suspension of operations.

As part of a phased plan to restore withdrawals, the exchange scheduled the initial resumption of withdrawals for November 1, with XRP included in the list of supported networks. Binance also reported that it covered approximately 95% of the affected amount. The remaining deficit was attributed to less liquid tokens, and the company committed to bearing the financial consequences.

Santiment's conditions

Santiment identified the $1.25 level as the nearest pivot point, with $1.30 as the first level to confirm stronger price dynamics. The company's forecast also depends on the sustained growth of new wallets. If growth remains above approximately 4,000 per day and XRP regains the $1.30 mark, the situation will become more favorable. A drop below $1.20 amid a slowdown in network growth below 3,000 will weaken this signal.

Additionally, on November 2, the attacker moved the stolen XRP to six new wallets after the assets remained virtually untouched for about 80 hours. These transfers occurred after the daily period marked by Santiment ended. Nine large payments made from 3:52 to 4:00 UTC allowed the redistribution of approximately 233.45 million XRP. At the time of writing, the XRP rate is $1.25.