In the latest significant crypto security incident, Binance has frozen $4.2 million worth of XRP stemming from the $112 million hack on Chris Larsen, a co-founder of Ripple. The hack, which occurred on January 31, stands as the largest crypto exploit of 2024 to date.
Binance CEO Richard Teng shared the news on social media platform X, acknowledging the efforts of on-chain investigator ZachXBT and the Ripple team for their coordination and assistance in freezing the exploiter’s address.
Thomas Silkjær, head of analytics and compliance at the XRP Ledger Foundation, contested Teng’s post, claiming that the foundation was the first to investigate the issue.
Initial speculations hinted at a potential hack of Ripple itself, with some reports erroneously suggesting a compromise of the XRP token. However, Larsen clarified that it was his personal accounts that fell victim to the attack, not the broader Ripple network.
Remarkably, the hacker did not employ crypto mixer services or decentralized exchanges to conceal their identity. This contrasts with recent trends, as most exploiters have been avoiding centralized exchanges to mitigate the risk of having their funds frozen.
ZachXBT later disclosed that the Ripple attribution for the affected account caused confusion. It was tagged in XRP block explorers XRPScan and Bithomp as Ripple itself, adding to the complexity of the situation.
Larsen divulged that several of his personal XRP accounts were compromised, resulting in the theft of 213 million XRP. Ripple is currently in discussions with crypto exchanges to freeze the exploiter’s address, and law enforcement agencies have been notified.
According to ZachXBT, the hackers managed to acquire 213 million XRP, valued at approximately $112.5 million, before attempting to launder the funds through at least six different exchanges, including MEXC, Gate.io, Binance, Kraken, OKX, HTX, and HitBTC.
While Binance has successfully frozen a portion of the pilfered funds, other crypto exchanges, such as OKX and Kraken, have yet to disclose whether they have identified or frozen any funds connected to the hack.
