Binance Freezes $4.2 Million In XRP Coins Linked To Exploit On Ripple’s Co-Founder’s Wallet

The global leading crypto exchange, Binance, froze about $4.2 million worth of XRP tokens on its platform. The frozen funds were part of the massive exploit on the personal wallet of Ripple co-founder Chris Larsen.

The Ripple executive lost 213 million XRP worth almost $112 million through a hack on January 30. Currently, the attack stands as the biggest hack of 2024.

Binance CEP Reports The Freezing Of The XRP Tokens

Binance CEO Richard Teng took to the X platform to disclose that the crypto exchange has frozen the tracked address of the hacker. According to Teng, Binance always maintains a quick response in fighting against hacks in the industry. 

Notably, the exploiter planned to use the Binance exchange to launder the stolen tokens but didn’t succeed as the exchange had frozen them. Further, the Binance CEO appreciated the role of the community in drawing the attention of exchanges to the attack.

Also, he acknowledged the roles and cooperation of the Ripple team and on-chain sleuth ZachXBT in managing the situation. Notably, ZackXBT was the first to discover the exploit and called out the public’s attention. 

After finding out early on about the exploit that occurred at @Ripple, we’re happy to say that the #Binance team has managed to freeze $4.2 Million worth of $XRP stolen by the exploiter.

We appreciate both the communities efforts in flagging it to exchanges – as always @zachxbt…

— Richard Teng (@_RichardTeng) February 1, 2024

Additionally, the Binance CEO pledged the exchange’s support to Ripple in the investigation of the exploit and possible recovery.

Teng stated:

We will continue to support Ripple in their investigations and their efforts to retrieve back the funds, including closely monitoring the majority of funds still in the exploiter’s external wallets in case they deposit to Binance.

Teng had thought the hack to be on Ripple wallets. However, Thomas Silkjær, Head of Analytics and Compliance at the XRPL Foundation, pointed out the ambiguity to him. 

Quickly, Teng owned up to the error and corrected his assertions that the exploit was on Chris Larsen’s wallet. On his part, ZackXBT thanked Teng and commended the Binance security team on its proactiveness on security challenges.

The Exploit on Ripple Chairman’s Wallet

Ripple Chairman and co-founder Chris Larsen recorded a hack on his personal wallet during the late hours of January 30. The blockchain sleuth, ZachXBT, discovered the exploit at the dawn of January 31. Initially, he mistook the attack to be on a Ripple wallet.

According to ZackXBT’s disclosure, a mislabeling on the address from XRPL explorers XRPScan and Bithomp caused the confusion, making it seem like a Ripple wallet.

It appears @Ripple was hacked for ~213M XRP ($112.5M)

Source address
rJNLz3A1qPKfWCtJLPhmMZAfBkutC2Qojm

So far the stolen funds have been laundered through MEXC, Gate, Binance, Kraken, OKX, HTX, HitBTC, etc pic.twitter.com/HKGYsLQeMv

— ZachXBT (@zachxbt) January 31, 2024

Also, ZachXBT mentioned that the hacker has started moving the stolen funds through some exchanges. 

He said:

So far, the stolen funds have been laundered through MEXC, Gate, Binance, Kraken, OKX, HTX, HitBTC, etc.

However, while confirming the exploit, Larsen clarified that he owns the affected accounts, not Ripple.

Yesterday, there was unauthorized access to a few of my personal XRP accounts (not @Ripple) – we were quickly able to catch the problem and notify exchanges to freeze the affected addresses. Law enforcement is already involved. https://t.co/T3HtKSlzLg

— Chris Larsen (@chrislarsensf) January 31, 2024

Moreover, Larsen mentioned that they have already notified law enforcement as they intensify their investigation of the attack. While Larsen acknowledged the breach of his personal wallets, he failed to include specifics on the entire incident.

The trend that the hacker has used in the funds transfers seems odd. Before now, attackers used crypto mixers such as the prominent Tornado Cash to drain and conceal stolen funds’ movements.

But the latest incident shows a shift in paradigm, making the entire incident more confusing.