Bitget Hack: $83M in XRP Transferred as Ripple Freeze Option Remains Unavailable

The attacker behind Bitget’s $387.5 million breach has moved about $83 million worth of stolen XRP from three of the five wallets that initially received the funds. Roughly $75 million in XRP remains in the original addresses.

Almost 103 million XRP was taken from Bitget on Thursday and distributed across five wallets. By 12:41 UTC Saturday, two addresses that had each started with about 20 million XRP held only around 23 and 55 XRP. A third wallet had about 5.8 million XRP remaining, according to CoinDesk’s review of XRP Ledger records.

XRP is the native asset of the XRP Ledger, which is used by payments company Ripple. Although the network allows issuers to build freezing controls into tokens they create, those controls do not apply to XRP. Ripple therefore has no native mechanism for freezing the attacker’s XRP or preventing further transfers.

The stolen funds could become easier to restrict if they reach a centralized exchange. Such platforms can suspend accounts receiving illicit XRP and stop withdrawals from those accounts. They cannot, however, freeze XRP while the coins remain in a wallet controlled by the attacker.

Circle and Tether have already frozen about $320,000 in USDC and USDT associated with the breach. Both stablecoins include issuer-controlled blacklist features that allow the companies to restrict specific addresses.

The stolen XRP has been moving at a faster pace since Friday night. At 04:32 UTC Saturday, the five original wallets held roughly 70 million XRP combined. About eight hours later, their balance had fallen to approximately 49 million.

The attacker has also reused transaction patterns seen earlier in the fund movements. One attempted transfer of about 521,000 XRP failed because the sending wallet lacked sufficient funds. Around an hour later, another wallet transferred the same amount to the intended recipient.

Approximately 54 million XRP has now been moved out of the original five wallets. The transactions show the attacker spreading the stolen assets among additional addresses, but they do not establish whether any of the XRP has already been sold.

XRP was trading at about $1.54 Saturday, down approximately 4% over 24 hours while remaining around 9% higher over the previous week, CoinGecko data showed.

At that price, the original XRP haul was worth close to $160 million, equivalent to roughly 4% of XRP’s reported $4.4 billion in daily trading volume. The market impact of any potential sale would depend on the amount of buy-side liquidity available when the orders are executed.

Bitget increased its estimate of the breach to $387.5 million Friday after adding Zcash and TRON transfers that had not been included in the company’s first accounting. The exchange said the additional assets were stolen during the same incident rather than through another attack.

Bitget has since confirmed that its protection fund is sufficient to cover the losses and that customer balances remain unaffected. Bitcoin withdrawals are scheduled to restart Sept. 28, with Ether following on Sept. 29, USDT on Sept. 30 and other tokens on Oct. 2.