TRM Labs says XRP was first asset taken in Binance wallet breach

Key points

• TRM Labs traced 233.46 million XRP leaving five Binance wallets between 20:05 and 20:09 UTC on 29 Oct, about $296m in value.
• Binance said on 31 Oct that XRP and nine other assets were fully backed, reporting 90% replenishment overall.

TRM Labs says the XRP theft came first in the Binance wallet breach, with five exchange wallets sending 233.46 million XRP to a single attacker address in about four minutes on 29 Oct. The blockchain intelligence firm put the loss at roughly $296m and said the transfers ran between 20:05 and 20:09 UTC, leaving each wallet with only its minimum balance.

Glassnode reported the same sequence, saying XRP went first, followed shortly by SOL, then BTC, ETH, USDT and TRX.

Ripple froze 40.5 million of its dollar-backed stablecoin RLUSD on Ethereum at 22:01 UTC on 29 Oct, TRM confirmed. The attacker had already sold 48 million of the 88.5 million RLUSD taken. Issuer freeze controls do not extend to XRP, so recovery depends on tracing and possible interception by exchanges. Elliptic found the stolen XRP unmoved as of 05:00 UTC on 31 Oct.

In its 31 Oct update it said XRP and nine other assets were fully backed and reported 90% replenishment overall, keeping a 1 Nov reopening target. Co-CEO Richard Teng has disclosed further breach points and bypassed approval controls.

What to watch: Binance expected its full proof of reserves for the ten assets by 3 Nov and has kept a 1 Nov reopening target.

Read the full story on Bitcoin.com News →