3.875 Billion US Dollars Stolen, 75 Million Can’t Be Frozen by Anyone
📈 进群一起盯盘
On September 24, an exchange was hacked and nearly 103 million XRP (about 160 million US dollars at the time) were stolen. Two days later, the hackers had moved about 83 million US dollars of the proceeds out of three wallets; the remaining roughly 75 million US dollars got stuck in the most awkward spot—under the XRP ledger rules, even the issuer itself has no right to freeze the XRP itself.
First, let’s lay out the facts clearly: the exchange initially reported a loss of 351.6 million US dollars. On Friday, after updating its figures to include Zcash and TRON transfers, the number was raised to 387.5 million US dollars. It emphasized that this was the same original incident, not a second hack. Nearly 103 million XRP were split into five accounts.
Transfers are accelerating. On Saturday at 04:32 UTC, the original five accounts still held about 70 million XRP; about eight hours later, only 49 million remained. By 12:41 UTC, one of the two accounts that originally held 20 million each had only 23 left, while the other had 55; the third dropped to about 5.8 million. In total, about 54 million XRP had left the original holding addresses. The funds are dispersed, but on-chain you can’t easily tell how much has been sold.
The difference between what can be frozen and what can’t is huge. The issuers of USDC and USDT—Circle and Tether—froze about 320,000 US dollars in stablecoins, which is less than one-thousandth of the stolen funds. The real bulk—the XRP itself—has no one-click freezing capability. Using 1.54 US dollars per XRP, the initial stolen XRP was worth about 160 million US dollars, roughly equal to 4% of that coin’s 4.4 billion US dollars daily trading volume. If you really want to sell, how deep you push depends entirely on the order book.
The controversy shifts to the side of on-chain protocols. The hackers routed part of the funds through cross-chain swaps, and the tracking group traced it to THORChain. The CEO of the hacked exchange publicly demanded that it refuse service to the identified addresses: “Decentralization is a design principle, not a shield for providing a channel for known stolen funds.” THORChain refused, and also likened itself to permissionless networks like Bitcoin and Ethereum.
The opposing side quickly found the soft spot. A founder of an exchange pointed out that THORChain’s TSS treasury is jointly controlled by a set of selected validators; once the signature threshold is met, assets inside can be moved. “Decentralizing the intermediary doesn’t equal eliminating the intermediary.” This year, in May, when its own treasury was hacked for about 10.7 million US dollars, THORChain could shut down: it first automatically froze signatures and transactions, then nodes added an additional layer of manual pause and governance voting. The system was fully down within about two hours. Its Q2 report admitted the interruption lasted about five weeks, and it only restarted on June 22 with patched code.
My view: what this exposes is not that a particular protocol is “not decentralized enough,” but that “decentralization” is being used as two different standards—when you need to avoid responsibility, it’s the excuse; when you need to deal with stolen funds, it’s the shield. Cross-chain bridges and DEXs can already handle flows of hundreds of millions of dollars, yet they still lack a mechanism to freeze only one address while letting all other transactions through. If this issue isn’t solved, every major stolen-funds case will walk down the same path again.
Two reminders: the exchange is restoring withdrawals in phases—Bitcoin starting September 28, Ethereum September 29, USDT September 30, and other tokens October 2. The stolen funds are still moving on-chain; addresses that receive XRP of unknown origin may have their accounts restricted by the platform.
Do you think cross-chain protocols should press the pause button for passing-by stolen funds? Let’s discuss in the comments. Click the avatar to watch the live stream.
Every day, I’ll bring you the latest crypto security hot topics—not just what happened, but also help you understand the logic and opportunities behind it 👀🚀
📈 进群一起盯盘
On September 24, an exchange was hacked and nearly 103 million XRP (about 160 million US dollars at the time) were stolen. Two days later, the hackers had moved about 83 million US dollars of the proceeds out of three wallets; the remaining roughly 75 million US dollars got stuck in the most awkward spot—under the XRP ledger rules, even the issuer itself has no right to freeze the XRP itself.
First, let’s lay out the facts clearly: the exchange initially reported a loss of 351.6 million US dollars. On Friday, after updating its figures to include Zcash and TRON transfers, the number was raised to 387.5 million US dollars. It emphasized that this was the same original incident, not a second hack. Nearly 103 million XRP were split into five accounts.
Transfers are accelerating. On Saturday at 04:32 UTC, the original five accounts still held about 70 million XRP; about eight hours later, only 49 million remained. By 12:41 UTC, one of the two accounts that originally held 20 million each had only 23 left, while the other had 55; the third dropped to about 5.8 million. In total, about 54 million XRP had left the original holding addresses. The funds are dispersed, but on-chain you can’t easily tell how much has been sold.
The difference between what can be frozen and what can’t is huge. The issuers of USDC and USDT—Circle and Tether—froze about 320,000 US dollars in stablecoins, which is less than one-thousandth of the stolen funds. The real bulk—the XRP itself—has no one-click freezing capability. Using 1.54 US dollars per XRP, the initial stolen XRP was worth about 160 million US dollars, roughly equal to 4% of that coin’s 4.4 billion US dollars daily trading volume. If you really want to sell, how deep you push depends entirely on the order book.
The controversy shifts to the side of on-chain protocols. The hackers routed part of the funds through cross-chain swaps, and the tracking group traced it to THORChain. The CEO of the hacked exchange publicly demanded that it refuse service to the identified addresses: “Decentralization is a design principle, not a shield for providing a channel for known stolen funds.” THORChain refused, and also likened itself to permissionless networks like Bitcoin and Ethereum.
The opposing side quickly found the soft spot. A founder of an exchange pointed out that THORChain’s TSS treasury is jointly controlled by a set of selected validators; once the signature threshold is met, assets inside can be moved. “Decentralizing the intermediary doesn’t equal eliminating the intermediary.” This year, in May, when its own treasury was hacked for about 10.7 million US dollars, THORChain could shut down: it first automatically froze signatures and transactions, then nodes added an additional layer of manual pause and governance voting. The system was fully down within about two hours. Its Q2 report admitted the interruption lasted about five weeks, and it only restarted on June 22 with patched code.
My view: what this exposes is not that a particular protocol is “not decentralized enough,” but that “decentralization” is being used as two different standards—when you need to avoid responsibility, it’s the excuse; when you need to deal with stolen funds, it’s the shield. Cross-chain bridges and DEXs can already handle flows of hundreds of millions of dollars, yet they still lack a mechanism to freeze only one address while letting all other transactions through. If this issue isn’t solved, every major stolen-funds case will walk down the same path again.
Two reminders: the exchange is restoring withdrawals in phases—Bitcoin starting September 28, Ethereum September 29, USDT September 30, and other tokens October 2. The stolen funds are still moving on-chain; addresses that receive XRP of unknown origin may have their accounts restricted by the platform.
Do you think cross-chain protocols should press the pause button for passing-by stolen funds? Let’s discuss in the comments. Click the avatar to watch the live stream.
Every day, I’ll bring you the latest crypto security hot topics—not just what happened, but also help you understand the logic and opportunities behind it 👀🚀
