Backend spoofing attack Sep 24. No private key theft. ~103M XRP ($157M). CEO Gracy Chen suspects DPRK-linked group. Mandiant and SlowMist investigating.