Where the First 100 Billion XRP Went
The XRP Ledger’s recorded history begins at ledger 32,570, on 1 January 2013, with the entire 100 billion XRP supply held across 136 accounts. Twenty-five days later, one of them moved 79 billion of it in five minutes and twenty seconds. This is what happened to the money after the records start — all of it in surviving history, all of it checkable.
How much of it can be put to a name
Before following the money it is worth asking how much of it is even identifiable. Our accounts records carry a name or a domain for 14 of the 136, and because the ledger was so concentrated those 14 cover 96.168% of every XRP in existence. Here is every one of them, with each holding priced at $0.00078 per XRP — not a ledger-32,570 price, because none existed, but the earliest contemporaneous market valuation of XRP that survives: the Ripple: XRP Price Tracker, kept publicly from 28 February 2013 and quoting XRP against BTC on the most liquid gateway of the day. It reports 60,000 XRP to the bitcoin at $47 a bitcoin, and states the resulting valuation of the full supply as $78 million — which is exactly what 100 billion ÷ 60,000 × $47 gives, so the figure checks itself. That is roughly ten weeks after ledger 32,570, and it puts every holding below in a real market context:
That is a 2023 fact about who holds the key now, so it is worth adding that the same account is independently confirmed in 2013. A February 2013 discussion of large XRP holders (ripper234, 23 February 2013) states that Joel Katz — Schwartz’s handle — held 1,060,024.99997 XRP. At the ledger closing that day, rHzWtXTB… held 1,060,024.99997 XRP. To the drop, eleven years before the domain was ever set. It is the only account in the set corroborated from both ends.
The two accounts holding 80% of the supply set no Domain on-chain at all. And ripple.com does publish a valid TOML — it simply does not list either address. So the largest attribution in XRP’s history is a third-party registry entry that the ledger does not corroborate and that Ripple could confirm at any time and has not.
The pattern is that the evidence runs opposite to the money. The one attribution that cannot be disputed covers a ten-thousand-XRP grant. The 8.189 billion credited to Chris Larsen comes from clustering addresses together, which is inference. The 80 billion comes from a registry.
Two of these accounts belonged to Ripple CTOs and they are almost the same size — David Schwartz at 10,000 XRP, Stefan Thomas at 9,973. Together that is 0.00002% of the supply. That is not an oddity in the data, it was the stated policy: asked directly in March 2013 whether developer holdings could be read out of the ledger, Schwartz answered that OpenCoin did not compensate employees or Ripple developers with XRP at all — “Opencoin does not compensate employees or Ripple developers with XRP”, 8 March 2013.
None of that means the labels are wrong. It means only one of them is proven, and it is the smallest.
Two accounts carry a domain rather than a registry entry, both self-asserted on-chain by the key-holder, and one of them resolves to a person. justmoon.net redirects to justmoon.com, which is Stefan Thomas’s site — so the handle names the holder the same way ahbritto does. The other, privateinternetaccess.com, is a VPN company and far more likely a customer than the company, so it stays unnamed. Neither domain names its address back — no xrp-ledger.toml at either — and since Domain accepts any string, a one-way claim is the key-holder’s own assertion. Enough to print a name against; not proof.
Where the unattributed 3.832% actually sits
A share with no name invites the assumption it is scattered across small holders. It is not. The fifteen accounts listed above hold 3.510% of the supply between them; the remaining 107 hold 0.322%.
Two of the remaining rows carry a relationship rather than a name. The 200-million pair at ledgers 8,410 and 8,412 is one operator: on 14 December 2017 both sent a 1 XRP test to the same address five minutes apart, and on 28 January 2020 both sent an identical 10,000,100 XRP seven minutes apart. Same signature as the founder pairs — adjacent funding, joint movement, matching amounts — but with no path into any labelled account, so it stays unnamed. And rHDcKZgR7J… is the only account in the whole table whose funder is proven: it shares a transaction hash with rJYMACXJd1… — the OpenCoin treasury — at ledger 26,946, which fixes where its 100 million came from.
Every unattributed row sits below ledger 32,570, so all sixteen were funded inside the lost era and none of those dates is recorded anywhere. They are estimated the way the lost-ledger reconstruction does it — anchored on ledger 32,569’s real close time, run back at 18.110 seconds per ledger — with the margin widening from about ±5 hours at ledger 26,946 to ±1 day 7 hours at ledger 237. The ledger numbers are exact; the dates are a model.
What is left is genuinely residual. The largest unattributed holding is now a billion-XRP account from the payout run, and no single one of them exceeds 1% of the supply. Naming any further account would move the total by fractions of a percent rather than by the 5.9 points the last one did.
The 80/20 split, and why founder holdings are not compensation
The supply divides exactly where the contemporaneous public record says it should: 80.00% in the company account, 20.00% everywhere else.
Which raises an apparent contradiction, since Schwartz stated in March 2013 that OpenCoin did not compensate employees or developers with XRP (8 March 2013) — while a co-founder and core developer held two billion. The two statements are about different things. Founder allocations are not company pay, and the funding order shows it:
ledger 85 1,000,000,000 ahbritto ledger 87 1,000,000,000 ahbritto ledger 150 79,997,608,219 the company account ← bounded AFTER both
Both founder billions are bounded at ledgers 85 and 87, before the company account’s own bound of 150 — so it had not yet reached its balance and cannot have paid them. The founder holdings run alongside the company’s, not out of it.
Where the data does speak to employee holdings, it agrees with him. The two Ripple CTOs in the set hold 10,000 and 9,973 XRP, bounded at ledgers 14,186 and 18,585 — well after the company account, standard retail grants, 0.00002% of supply between them.
79 billion XRP in five minutes
At the horizon, one account held 80% of all XRP: r8TR1AeB…, with 79,997,608,219 XRP received and a lifetime total of two transactions sent. It is one of only five founding accounts carrying a curated attribution, and that attribution is Ripple Labs.
On 26 January 2013, between 22:35:20 and 22:40:40 UTC, it sent twelve payments totalling 79,000,000,000 XRP to exactly nine addresses, in round eight- and nine-billion blocks roughly thirty seconds apart:
Nothing about this is hidden or unusual for the period — it is a company moving its own holdings out of one account into several, at a time when the ledger carried almost no other traffic. What makes it worth reading closely is the shape: round denominations, evenly spaced, all inside one five-minute window. That is a script running, not a person clicking.
The nine were a relay, not a destination
None of the nine kept the money. Every one forwarded it on and has sat nearly empty ever since — and because the ledger records how many transactions an account has ever signed, we can see how little they ever did. Eight of the nine signed exactly three transactions in their entire lives.
Between them the nine hold 856.10 XRP today, against the 79 billion that passed through — about a millionth of one percent.
Two of the billion-XRP grants converge, three years later
Four accounts received a round billion XRP in the lost era. Two carry the handle ahbritto; two carry nothing. Following all four forward separates them cleanly, and the two unnamed ones turn out not to be independent at all.
The two ahbritto accounts emptied on the same day into his own numbered addresses — a straightforward consolidation. The two unnamed billions also emptied on a single day, 19 December 2013, and both balances end up in rshGD78D… — an account created on 1 March 2016 with 100 XRP by rEhKZcz5…, the account registered to the username tacostand. Within two days it took in five payments totalling just under 5 billion XRP — the two traced billions among them — and in May 2017 it paid out 4,668,132,984 XRP in one transaction. It holds 21 XRP today.
What is not established: ownership, formally. Creating an account does not prove you hold it — tacostand was itself created by r3kmLJN5…, which our records label Ripple, and tacostand is not Ripple’s. What rules Ripple out here is different and stronger: the February 2013 list of company holdings names eleven addresses and excludes these two, while both still held their full billion on that date.
One account in the chain does carry a label: the 300,000,000 XRP that rDtosGgC… split off in March 2016 went to an address our records name Ripple — and that address was created six ledgers after rshGD78D…, by the same funder. A receiving account with a company label is a payment destination, not evidence about the source.
The founding cohort is functionally extinct
The same pattern holds for the whole group. All 136 accounts that existed at ledger 32,570 still exist — none was ever deleted, which the protocol made impossible until 2020 anyway. But between them they now hold 49,681,555.5 XRP of the 100 billion they started with.
Those 136 accounts were the entire XRP Ledger on 1 January 2013. Thirteen years later they are a rounding error in it. The supply did not shrink — it moved, into accounts created later, and the original holders are almost all empty shells that still respond when you ask about them.
What this changes about the concentration
The lost-ledger reconstruction shows an extraordinarily concentrated ledger at the horizon: one account with 80% of the supply, seven accounts with 98.11% of it, and 40 accounts holding a standard 10,000 XRP grant each. That concentration is usually read as a fact about XRP’s early distribution.
It did not last. The single account holding 80% of everything kept it for twenty-five days. The nine addresses it emptied into held their share for four months. By the time the ledger had any meaningful traffic, the distribution recorded at the horizon had already been dismantled and replaced.
Method
Every figure comes from ledger 32,570 onward, which means all of it is in surviving history and none of it required reconstruction. Balances and sequences at the horizon are read from ledger_data at ledger 32,570; transaction histories from account_tx paginated to completion; present-day balances from account_info at the validated ledger. All against s1.ripple.com.
Payment amounts are taken from the balance delta on the sender’s own AccountRoot rather than from delivered_amount, which reads unavailable on payments this old.
For what the ledger proves about the era before this one, see Inside XRPL Ledgers 1–32570.