Nov 2, 2026

The stolen XRP moved for the first time since the theft. After 1,000 XRP test payments from 03:47 UTC Monday, the attacker's holding address sent its entire 233.46 million XRP, about $293 million, to six newly created wallets between 03:52 and 04:00 UTC, leaving 23.7 XRP behind (Bitcoin.com). Five wallets now hold about 40 million XRP each and the sixth about 33.45 million. Elliptic places the move inside a laundering phase that spans about 12,000 wallets across 11 blockchains, with about $3.24 billion still sitting in theft-linked addresses (Elliptic via TokenPost).

What has not happened: as of 10:26 UTC none of the six wallets had sent anything onward, and no exchange deposit has been reported (99Bitcoins). Splitting a stash is a standard step before laundering, but the move alone does not establish that a sale is coming.

Why it matters: XRP is a native asset, so no issuer can freeze it; the brakes are exchanges refusing deposits from the attacker addresses the FBI published and asked service providers to block (Unchained). XRP has held a $1.24 to $1.27 range since Saturday (99Bitcoins), so the market has not priced a dump. The watch item tracking the original address closes today; a new one tracks the six wallets.

Binance began restoring withdrawals in phases at 06:00 UTC Nov 1. In the first nine and a half hours it processed $4.65 billion of withdrawals against $1.01 billion of deposits, a net $3.64 billion, which it put at 2.1% of $171 billion in assets from its Oct 28 proof of reserves (CNBC). By Monday morning in London, net withdrawals had reached $4.7 billion, under 3% of $166 billion in assets, a Binance spokesperson told Bloomberg. The two figures cover different windows, so the larger one is the running total, not a revision. DefiLlama's 24-hour count of about $4.05 billion can include transfers between Binance's own wallets (FinanceFeeds).

Binance says it has replenished about 95% of the affected assets, up from 90% Saturday. The FBI attributed the theft to North Korea's TraderTraitor on Oct 31 and published hundreds of attacker addresses (Decrypt). Circle said it froze more than $1.1 billion of USDC with law enforcement (CNBC).

Why it matters: this was the withdrawal test the market was waiting for, and so far it reads as an orderly exit, not a run: a few percent of assets left, mostly in the first hours. Counter-evidence: Binance's status page still showed withdrawals suspended for 531 of 552 coins on Sunday (Implicator), so the full test has not run, and the promised proof of reserves had not been published at run time.

January Brent, the front month since Friday's expiry, traded $108.96 at 7:30 a.m. ET, down 3.9% from Friday's $113.43 settle (JKN), and later near $106.50 (OilPrice.com). WTI December fell below $100. The trigger: President Pezeshkian said Supreme Leader Mojtaba Khamenei granted the government "certain authorities" over talks with Washington (Seeking Alpha). The scope was not specified, and strategic decisions stay with the Supreme Leader (investingLive). Iranian negotiators left Doha Sunday and a draft proposal is circulating for a follow-up meeting, a source told Reuters (OilPrice.com). OPEC+ held December output unchanged.

What did not change: Iran's terms still put lifting the blockade, releasing frozen funds and sanctions relief ahead of reopening Hormuz (investingLive), and CENTCOM says the blockade has redirected 144 vessels (CBS News). Axios reports Netanyahu is pressing Trump to strike right after Tuesday's midterms, while Trump says talks are "going fine" and he is not "in much of a hurry." A viral post that Brent crashed on a deal "nearing" overstates it: there is no deal text and no direct meeting.

Why it matters: both oil gauges key off settles, and Brent is still about $16.50 above the $90.00 improve marker (desk calc). Macro Backdrop needs five settles under $100; the count stays zero. Comparing Monday with the expired December contract's $117.64 would overstate the drop.

Only five commodity vessels transited Saturday and none Sunday, against 31 the previous weekend, per Kpler ship-tracking (Sigmalive). That is a different series from the Reuters preliminary count the gauge uses, which was not located again this run, and it conflicts with Windward's count of about 24 AIS-visible transits from Oct 30 to the morning of Nov 1 (Windward). The desk does not blend them.

Strikes continued. UKMTO logged a vessel struck by an unknown projectile at 15:09 UTC Nov 1 inside the strait (Arab Times). Qatar's Nakilat said its LNG carrier Al Mayeda was struck by unidentified objects on Oct 30, with no injuries (Arab News); Bloomberg reports Iran had cleared the voyage hours earlier (gCaptain), and no one has claimed it. Iran's Navy said Monday a tanker caught fire after hitting a mine east of Hormuz with its AIS off (Newsquawk), and the IRGC claims 11 tankers burned since Oct 25 (Daily Beirut). Neither Iranian claim names a vessel.

Why it matters: the improve test needs five sessions at or above the ten-day average with no new strike, so new strikes keep the count at zero. An attack on a cargo Iran itself cleared undercuts the idea that Tehran's permission guarantees passage. Verdict scope: the UKMTO and Nakilat incidents are verified; the transit collapse rests on one provider, and the Iranian mine claims are unverified.

The fixCleanup3_4_0 amendment is on track to activate Wednesday at about 14:46 UTC, with support from 33 of 35 tracked validators (CoinDesk). It closes a loophole where an account authorized only to burn an issuer's tokens could mint new ones under certain conditions, for example a payments partner that a stablecoin issuer allowed to burn redeemed tokens. XRP's own supply is unaffected. The package also corrects calculations used when issuers recover tokens from trading pools and when users move assets in and out of vaults. Activation was first expected Oct 23; support dipped to 26 on Oct 21 and restarted the two-week clock. The lending amendment the fixes prepare for still sits at 19 votes, its vault dependency at 21 (CoinDesk).

Why it matters: issued tokens on the ledger, stablecoins included, get a permission hole closed before lending goes live, and the ledger's documentation has warned developers off granting the burn permission until then (Bloomingbit). Amendments never move a gauge, and this one counts as verified only once it is enabled on ledger.

Finance Minister Katayama said the joint FX statement with the US persists and Tokyo will act against disorderly moves, noting that PM Takaichi calls yen undervaluation a problem (FXStreet). She also said current levels are "neither good nor bad", that conditions have improved, and declined to name a level. The pair barely reacted: USD/JPY traded near 157.84 in Tokyo Monday morning (Japan Times via Alo Japan) and the 158.00 area in Asia (FXStreet). Newsquawk reads the wording as the opening rung of the verbal ladder, short of warnings about speculation or readiness for decisive action.

The 10-year JGB closed 2.774%, little changed (Investing.com). The US-Japan 10-year spread is about 2.13 points (desk calc: Treasury 10-year 4.906% early Monday, CNBC, minus 2.774%), down about 3 bp.

Why it matters: the Yen Carry arrow stays worsening, with the pair about 2 yen from the 160 close that moves the gauge to ELEVATED and about 2 yen above the 156 close that resolves the arrow. The tell would be harder language about speculation, or a three-yen session.

The People's Bank of China shifted its main policy rate from the seven-day to the overnight reverse repo on Monday and conducted 541 billion yuan of overnight operations (Xinhua) at 1.25% (Reuters via 93.3 The Drive). Analysts told Reuters the switch lowers the floor of the rate framework by about 15 bp, and the PBOC said last week it will run overnight operations daily (The Standard).

What it is not: a circulating post framed this as an $81 billion daily injection. The 541 billion yuan is the gross first-day operation; gross is not net when earlier operations mature the same day, and the desk has not confirmed a net figure. It is also not a conventional rate cut.

Why it matters: it is the clearest easing step from a major central bank this month. It does not move Global Liquidity, which is keyed to the Fed: a cut fires SUPPORTIVE, a second 2026 hike fires TIGHTENING, and the next test is Dec 9.

Standard Chartered launched tokenized deposits for corporate clients in Hong Kong, the first market in its network, built on its own proprietary blockchain and settling through the HKMA's EnsembleTX (FX News Group). China AMC, Finloop and PantherTrade have already executed live transactions, and the bank is working with Fireblocks, with HashKey onboard (Bitbase).

A widely shared post called it a launch by a "Ripple partner." Neither the bank's announcement nor the coverage of it mentions Ripple, XRP or the XRP Ledger. The desk logs the Ripple-rails reading as unverified: the documents are silent, which is not the same as contradicting it.

Why it matters: tokenized bank deposits compete for the same corporate treasury use case as stablecoins such as RLUSD. Bank adoption of tokenization is a separate variable from XRP demand.