Binance hack’s stolen bitcoin, XRP sit unspent, unfrozen

The record theft at Binance started on the XRP Ledger. Between 20:05 and 20:09 UTC on Thursday, Oct. 29, five Binance wallets sent 233.46 million XRP ↗ 0.01%, worth about $296 million, to one attacker address, TRM Labs found. Each wallet was left holding only its minimum balance. Roughly 18,270 Bitcoin ↘ 0.06% taken in the same attack now sits unspent across 19 addresses, and the XRP remains in a single account, The Defiant reported.thedefiant.io+1

These are the largest stolen holdings that no one can freeze. That makes them a key part of a breach Binance puts at about $6.3 billion. Analysts have blamed North Korea, and the theft is the largest in crypto history, Reuters reported.reuters.com

Bitcoin split into 19 wallets

At 20:20 UTC, a Binance hot wallet sent just over 18,270 BTC to one address in 11 transactions. The attacker then split the coins into 19 wallets within minutes, according to a CoinDesk trace. Seventeen of the wallets hold exactly 1,000 BTC each, one holds 832.5 BTC and one holds 437.7 BTC. The coins were worth about $1.4 billion at early Friday prices.coindesk.com

None of the Bitcoin, XRP, Solana ↘ 0.10% or NEAR ↘ 0.05% has been frozen, because native assets have no issuer that can freeze them, Elliptic said. "Ripple, for example, can freeze RLUSD but not XRP," the firm noted. It added that the stolen XRP, SOL and NEAR, worth about $445 million, have not moved at all. Data firm Bitquery reported that the receiving XRP Ledger account had not existed a minute before the drain and has never sent a transaction.bitquery.io+1

Freezes cover about half

Stablecoins were easier to stop. Tether froze nearly $1.57 billion and Circle froze more than $800 million, Reuters reported. Binance co-founder Yi He said Ripple helped stop about $200 million. TRM said it could confirm only 40.5 million RLUSD frozen on-chain. In total, Binance says about $3 billion has been frozen, CNBC reported, and the exchange has pledged to cover all losses.cnbc.com+2

How the attack happened

Binance said its first findings point to a compromised DevOps engineer's laptop. The exchange said the laptop let an attacker "gain access to a service container and submit unauthorized withdrawal transactions," NBC News reported. Binance also said it found no evidence that any private key had leaked.nbcnews.com

TRM attributes the attack "with high confidence" to TraderTraitor, a North Korean hacking unit. The firm said preparation began at least 36 hours earlier, starting with small Tornado Cash withdrawals on Oct. 28, Newsweek reported. Deposits and withdrawals remain suspended. As of about 0900 GMT on Friday, Binance said it was on track to resume withdrawals in 45 hours, AFP reported.afp.com+1