According to the official statement, the reason for the theft is a vulnerability in a third-party backend tool, which allowed fake instructions to bypass the wallet's approval process. The reason withdrawals are currently on hold is that it's unclear if the vulnerability has been fully patched, and resuming withdrawals hastily could lead to another theft. The stolen assets currently amount to approximately 103 million XRP + 31,890 ETH, with a total value of around $357 million, slightly revised up from the previous $351.6 million. The characteristics of the attack's IP address match the VPN patterns commonly used by known North Korea-linked hacker groups.