The hacker responsible for the recent Bitget breach has shifted roughly $83 million worth of XRP out of three holding wallets, according to blockchain analysis. About $75 million of the stolen XRP remains in five original accounts that are not subject to the XRP Ledger's freeze rules.
Bitget disclosed that 103 million XRP were taken on Thursday and split among five wallets. By Saturday morning, two of the wallets that initially held about 20 million XRP each had been reduced to roughly 23 million and 55 million tokens, while a third wallet fell to about 5.8 million XRP. The remaining balances fell from around 70 million tokens at 04:32 UTC to 49 million tokens eight hours later as the attacker redistributed the funds across additional addresses.
The XRP Ledger permits issuers to freeze tokens they create, but that capability does not extend to the native XRP cryptocurrency. Consequently, Ripple has no mechanism to block the attacker’s transactions. Recovery now depends on exchanges that receive the stolen XRP; they can restrict the recipient’s account but cannot freeze the coins while they remain under the hacker’s control.
Circle and Tether, the issuers of USDC and USDT stablecoins, have each frozen addresses linked to the breach, collectively locking about $320,000 in stablecoins. Their token contracts include blacklisting functions that allow such actions.
Bitget said its protection fund will cover the loss, and customer balances are unaffected. The exchange plans to resume withdrawals in stages: Bitcoin on Sept. 28, Ether on Sept. 29, USDT on Sept. 30, and other tokens on Oct. 2.
At the time of reporting, XRP traded near $1.54, down about 4 % over the previous 24 hours but still up roughly 9 % for the week. At that price, the original 103 million XRP haul was valued at about $160 million, representing roughly 4 % of the token’s reported daily trading volume of $4.4 billion. Bitget later revised the total theft estimate to $387.5 million after accounting for additional Zcash and TRON assets taken during the initial breach.
