The hacker behind Bitget’s roughly $387.5 million breach has moved about $83 million in stolen XRP out of three holding wallets, while about $75 million remains across the five original accounts, according to CoinDesk.
Those remaining XRP cannot be frozen under the XRP Ledger’s current rules. Exchanges can restrict accounts that receive the stolen funds, but Ripple cannot block transfers from wallets controlled by the attacker. Circle and Tether have separately frozen about $320,000 in related stablecoins.
Three wallets have already been drained or are being drained
CoinDesk’s review of XRP Ledger records showed that nearly 103 million XRP was taken from Bitget on Thursday and split among five accounts. By 12:41 UTC on Saturday, two wallets that initially held 20 million XRP each had been reduced to about 23 and 55 tokens. A third wallet had fallen to about 5.8 million XRP.
About 54 million XRP has now left the original holding accounts. The transfers show the attacker spreading the stolen funds across additional wallets, though the on-chain records do not show how much of that XRP has been sold.
Why Ripple cannot freeze the stolen XRP
XRP is the native asset of the XRP Ledger, the blockchain used by payments company Ripple. The network allows companies to freeze tokens they issue on it, but that authority does not extend to XRP itself. Ripple has no built-in mechanism to stop the attacker from spending those coins.
That leaves recovery efforts partly dependent on where the funds move next. If an exchange receives stolen XRP, it can restrict the recipient account and block withdrawals. It cannot freeze the coins while they remain in a wallet controlled by the attacker.
USDC and USDT work differently. Their issuers can blacklist addresses, and Circle and Tether have already frozen about $320,000 in stablecoins linked to the breach.
Transfers sped up overnight
The XRP movements accelerated overnight, CoinDesk reported. At 04:32 UTC on Saturday, about 70 million tokens remained in the original five accounts. Roughly eight hours later, that balance had dropped to 49 million.
Some transfers followed routes already used by the first wallet. After an attempted transfer of about 521,000 XRP failed because the account lacked sufficient funds, the second wallet sent the same amount to the intended recipient about an hour later.
XRP price and the size of the stolen holdings
According to CoinGecko, XRP traded around $1.54 on Saturday, down about 4% over 24 hours while still holding a weekly gain of about 9%.
At that price, the original stolen XRP was worth roughly $160 million, equal to about 4% of the token’s reported $4.4 billion daily trading volume. CoinDesk noted that any price impact from sales would depend on the buy orders available at the time.
Bitget raised its theft estimate and set a withdrawal timetable
Bitget raised its estimate of the total theft to $387.5 million on Friday after adding Zcash and TRON transfers that were missed in its initial accounting. The exchange said the higher figure reflected assets taken in the original breach, not a separate attack.
Bitget has since confirmed that its protection fund will cover the losses and that customer balances remain unaffected. Bitcoin withdrawals are scheduled to resume on Sept. 28, followed by ether on Sept. 29, USDT on Sept. 30 and other tokens on Oct. 2.