Philippines-based exchange Coins.ph appears to have lost 12.2 million XRP in possible exploit

Quick Take

The Philippines-based crypto exchange Coins.ph lost 12.2 million XRP tokens in what appears to have been an exploit on Tuesday.
A hacker appears to have sent XRP tokens through OKX, WhiteBIT and two non-custodial exchanges, among other destinations.
A person familiar with the matter confirmed the security incident to The Block.

The Philippines-based crypto exchange Coins.ph appears to have experienced an exploit on Tuesday that resulted in the loss of more than 12 million XRP tokens ($6 million).

Within about 30 minutes, a supposed hacker exchanged 999,999.999 XRP lots 13 times, in addition to another lot of 200,000 XRP, according to the blockchain explorer XRP scan.

Exploit on the crypto exchange Coins.ph. Image: XRP Scan

However, it appears that one of the transactions didn't go through.

Exploit on the crypto exchange Coins.ph, including what appears to be a rejected transaction. Image: XRP Scan

After gaining nearly 12.2 million XRP tokens, the hacker then sent the coins through the crypto exchange OKX, the European crypto-to-fiat exchange WhiteBIT, the cross-blockchain exchange OrbitBridge, the crypto exchange SimpleSwap, two non-custodial exchange ChangeNOW and Fixed Float, as well as other destinations.

A few places where the Coins.ph exploiter sent XRP. Image: XRP Scan

Coins.ph did not immediately respond to a request for comment from The Block.

"WhiteBIT, as soon as received a request from the Philippines-based exchange Coins, promptly reacted and blocked 445,000 Ripple," a WhiteBIT spokesperson said in an email to The Block. "In addition, WhiteBIT has reached out to Cristal and Chainalysis, requesting to flag addresses associated with stolen cryptocurrencies."

(Updates to add comment from WhiteBIT; corrects to remove depiction of wallet custody.)