The hacker behind Bitget’s $388 million security breach has transferred roughly 54 million stolen XRP from three of the five wallets that originally received the funds. The movement has renewed concerns that the tokens could eventually add selling pressure to XRP.
Almost 103 million XRP was taken from Bitget and distributed across five wallets following the compromise of the exchange’s wallet infrastructure. While the amount stolen remains unchanged, the funds are no longer sitting in the same addresses. After being mostly dormant for around a day, portions of the stolen XRP have started moving to new wallets.
The transfers raise the question of whether a sale could follow. Such movements can sometimes precede an attempt to liquidate stolen assets, but the on-chain activity by itself does not establish that any XRP has been sold.
By 12:41 UTC on Saturday, two wallets that had each received 20 million XRP were left with approximately 23 XRP and 55 XRP. A third wallet containing a larger portion of the stolen funds had fallen to roughly 5.8 million XRP. At that point, around 49 million XRP, worth approximately $75 million, remained in the five original wallets.
XRP was trading around $1.47, down roughly 3% over 24 hours but still up about 3% for the week. The relatively limited price reaction suggests traders are treating the transfers as a potential source of supply rather than evidence that a large-scale dump is already underway.
The stolen XRP was valued at approximately $160 million when it was taken, equivalent to around 4% of XRP’s reported $4.4 billion in daily trading volume. However, headline trading volume does not indicate how much actual order-book liquidity is available to absorb a large sale.
Why the Stolen XRP Cannot Be Frozen in the Wallet
An exchange that receives identified stolen XRP can flag the deposit, restrict the related account and prevent withdrawals. Those controls, however, do not extend to XRP held in a private wallet that remains under the attacker’s control.
XRP is the native asset of the XRP Ledger, and its status is central to the issue. The ledger’s freeze functionality applies to issued tokens rather than native XRP. Consequently, Ripple does not have a built-in mechanism to freeze XRP sitting in an attacker-controlled wallet.
If the remaining funds continue moving between private addresses, the blockchain will show transfers without confirming a sale. In that case, the potential effect on XRP’s price remains speculative.
A stronger indication of possible selling would emerge if the stolen tokens were transferred to a recognizable exchange address or swapped for another asset on-chain. Even then, the actual market impact would depend on available buy-side liquidity at the time.
Bitget Recovery Timeline Continues
Bitget’s recovery efforts are proceeding separately from the movement of the stolen XRP. The exchange has scheduled Bitcoin withdrawals to resume on September 28, followed by Ethereum on September 29, USDT on September 30 and other tokens on October 2.
Bitget has stated that its protection fund will cover the losses and that customer balances have not been affected.
The focus therefore remains on the approximately $75 million worth of XRP still sitting across the original wallets and whether those funds remain dormant, move to new addresses or eventually reach an exchange or another venue where they could be sold.
