The attacker behind Bitget’s $387.5 million security breach has moved approximately $83 million in stolen XRP from three wallets, while roughly $75 million remains spread across the five addresses that initially received the funds.
The attacker took nearly 103 million XRP from Bitget on Thursday and distributed the tokens among five separate accounts. By 12:41 UTC Saturday, two wallets that had each started with about 20 million XRP were left with only around 23 and 55 tokens, respectively, based on CoinDesk’s examination of XRP Ledger records. Another wallet contained approximately 5.8 million XRP.
XRP is the native cryptocurrency of the XRP Ledger, the blockchain associated with payments company Ripple. Although the network supports freezing functions for certain issued tokens, those controls do not apply to XRP. Ripple therefore does not have a mechanism within the network to freeze or block the stolen XRP while it remains under the attacker’s control.
The possibility of recovering the funds depends partly on where the stolen assets are eventually transferred. Exchanges can identify and restrict accounts that receive illicit XRP and prevent withdrawals, but they cannot directly freeze coins sitting in a wallet controlled by the attacker.
Stablecoin issuers Circle and Tether have already taken action on another portion of the stolen assets. The companies froze approximately $320,000 worth of USDC and USDT connected to the breach. Both stablecoins include blacklist functionality that allows their issuers to restrict designated addresses.
The XRP movements accelerated during the overnight period. At 04:32 UTC Saturday, about 70 million XRP was still held across the five original wallets. Roughly eight hours later, that combined amount had dropped to around 49 million XRP.
The attacker has also repeated transaction patterns used earlier in the movement of the funds. One transfer involving approximately 521,000 XRP failed because the wallet did not have enough tokens available. Around an hour later, a second wallet sent the same amount to the destination originally targeted.
Around 54 million XRP has now been moved out of the five initial wallets. The transfers indicate that the attacker is distributing the stolen tokens among additional addresses, though blockchain activity alone does not show whether the XRP has been sold.
XRP was trading at approximately $1.54 on Saturday, according to CoinGecko. The token was down about 4% over 24 hours but remained roughly 9% higher over the previous seven days.
Based on the $1.54 price, the original XRP stash was worth approximately $160 million. That amount equates to about 4% of XRP’s reported $4.4 billion in daily trading volume. Any market impact from a potential sale would depend on the available buy-side liquidity at the time of execution.
Bitget revised its estimate of the breach on Friday, raising the total loss to $387.5 million after identifying Zcash and TRON transfers that had not been included in its original calculation. The exchange said the additional assets were part of the initial incident and did not represent a second attack.
Bitget has since said its protection fund can cover the losses and that customer account balances remain intact. The exchange plans to restart Bitcoin withdrawals on Sept. 28, followed by Ether on Sept. 29, USDT on Sept. 30 and other cryptocurrencies on Oct. 2.
