The biggest haul in a hacker’s hands isn’t Ethereum.
The security team updated the tagged addresses: across 7 Ripple network addresses, there are a total of about 102.9 million XRP—worth roughly $157 million at the time. In addition, there are 11 EVM addresses and 1 TRON address. Together, the former have about 68,000 ETH, 5,896 BNB, 218,022 USDT, and 99,989 USDC. The latter holds about 20.59 million TRX.🔍
In terms of amount alone, the XRP entry is the largest. But when you look at the distribution of assets, you can actually see the fingerprints of the selections made.
Stablecoins are the easiest category for someone to act on passively: they have issuers who can freeze them. So we’ve seen actions like this on-site: stablecoins were quickly swapped into Ethereum. In six minutes, using two exchange protocols—better to eat a bit of slippage. What remained unmoved were XRP, TRON, and part of the ETH. These types don’t have centralized freeze switches, so anyone trying to track them would have to rely on labels and cooperation from exchanges.
How easy it is to track never depends on the amount—it depends on whether anyone can stop this money.
These addresses are still being tagged one after another; the numbers themselves change every day. For recovery, focusing on the addresses is more practical than calculating the total amount. These tags are also still increasing.
And to clearly refute it: if, in the short term, these XRP addresses are frozen in coordination by the issuer(s) or exchanges—so that funds can’t move—then the claim that “leaving them on non-stablecoins makes them harder to intercept” would not hold.
The security team updated the tagged addresses: across 7 Ripple network addresses, there are a total of about 102.9 million XRP—worth roughly $157 million at the time. In addition, there are 11 EVM addresses and 1 TRON address. Together, the former have about 68,000 ETH, 5,896 BNB, 218,022 USDT, and 99,989 USDC. The latter holds about 20.59 million TRX.🔍
In terms of amount alone, the XRP entry is the largest. But when you look at the distribution of assets, you can actually see the fingerprints of the selections made.
Stablecoins are the easiest category for someone to act on passively: they have issuers who can freeze them. So we’ve seen actions like this on-site: stablecoins were quickly swapped into Ethereum. In six minutes, using two exchange protocols—better to eat a bit of slippage. What remained unmoved were XRP, TRON, and part of the ETH. These types don’t have centralized freeze switches, so anyone trying to track them would have to rely on labels and cooperation from exchanges.
How easy it is to track never depends on the amount—it depends on whether anyone can stop this money.
These addresses are still being tagged one after another; the numbers themselves change every day. For recovery, focusing on the addresses is more practical than calculating the total amount. These tags are also still increasing.
And to clearly refute it: if, in the short term, these XRP addresses are frozen in coordination by the issuer(s) or exchanges—so that funds can’t move—then the claim that “leaving them on non-stablecoins makes them harder to intercept” would not hold.
