EntryCrypto

Analysis

Original reporting from EntryCrypto: on-chain investigations of hacks, exchange incidents and market events, with the addresses and transactions to check our work. RSS.

  1. Bitget hack, four days later: $388M confirmed, 60 million XRP deposited into four Binance accounts, 19,000 ETH through THORChain

    Bitget has raised the loss to $387.5M, blamed a zero-day in an unnamed third-party security product and restarted withdrawals. On-chain, every XRP parking wallet is empty: at least 59.9 million XRP went into four Binance customer accounts between September 25 and 28, and about 19,000 ETH was swapped through THORChain. Half the ETH is still parked.

    · bitget, hack, xrp, ethereum, binance, thorchain, lazarus

  2. Bitget hack: where the $351.6M went, traced on-chain

    We traced the Bitget exploiter's wallets across Ethereum and Avalanche. About 68,300 ETH ($184M) now sits in eight addresses that have not sent anything out, and outflows from the same hot wallets continued for nearly three hours after Bitget says it detected the attack.

    · bitget, hack, security, on-chain

  3. Bitget hack, part 2: the $160M in XRP that nobody can freeze is already starting to move

    Nearly half of the Bitget haul is 102.9 million XRP sitting on the XRP Ledger, where native XRP cannot be frozen. We traced it into five parking wallets, found the first small outflows through fresh hop accounts, and found that Bitget refilled a wallet that was still being drained.

    · bitget, hack, xrp, on-chain

  4. Bitget hack, part 3: the stolen XRP is flowing into a laundering pipeline that deposits to Binance and MEXC

    XRP peeled from a Bitget attacker wallet is entering a hub-and-exit network that was set up on September 17 to 20 and has pushed at least 1.8 million XRP into Binance and MEXC deposit accounts in small chunks. The first deposit traceable to a Bitget tranche hit Binance at 11:06 UTC. We name the exchange wallets and the fixed destination tags.

    · bitget, hack, xrp, laundering, binance, mexc

  5. Bitget hack, part 4: the XRP drain is accelerating, with 1.5M XRP out of the parking wallet and half a million already inside Binance

    Between 12:17 and 12:25 UTC the Bitget attacker released 789,000 XRP from one parking wallet, five times the earlier tranches, and pushed it straight into the feeder accounts of the laundering pipeline. Exchange deposits since 10:30 have reached 120 transactions and 488,000 XRP. Neither Binance nor MEXC has acted.

    · bitget, hack, xrp, laundering, binance