The hacker responsible for the Bitget breach has moved about $83 million worth of stolen XRP from three of the wallets holding the funds, leaving approximately $75 million across the five addresses that originally received the stolen tokens.
Nearly 103 million XRP was withdrawn from Bitget on Thursday and split among five wallets. By 12:41 UTC Saturday, two addresses that had each received roughly 20 million XRP were almost empty, containing only about 23 and 55 XRP. A third wallet had been reduced to around 5.8 million XRP, according to CoinDesk’s review of XRP Ledger transactions.
XRP is the native asset of the XRP Ledger, a blockchain used by payments company Ripple. While issuers of tokens on the network can use built-in controls to freeze their assets, XRP does not have the same functionality. Ripple therefore cannot directly prevent the attacker from moving or spending the stolen XRP.
That makes the destination of the stolen funds important for potential recovery. Exchanges can lock accounts that receive illicit XRP and stop withdrawals from those accounts. However, they cannot freeze XRP that remains inside a wallet controlled by the attacker.
Circle and Tether have already frozen approximately $320,000 in USDC and USDT linked to the breach. Unlike XRP, those stablecoins have issuer-controlled mechanisms that allow addresses to be blacklisted.
The pace of the XRP transfers increased overnight. At 04:32 UTC Saturday, the five original wallets collectively held about 70 million XRP. Approximately eight hours later, that figure had fallen to 49 million.
The attacker has also repeated some of the transaction patterns seen earlier. A transfer of around 521,000 XRP initially failed because the wallet did not have enough funds. Roughly an hour later, another wallet sent the same amount to the intended destination.
Approximately 54 million XRP has now moved out of the original five addresses. While the transactions show that the attacker is spreading the funds among additional wallets, they do not indicate whether any of the XRP has been sold.
XRP traded near $1.54 on Saturday, down around 4% over 24 hours but still up approximately 9% for the week, according to CoinGecko.
At $1.54 per token, the original XRP holdings were worth roughly $160 million, equivalent to about 4% of XRP’s reported $4.4 billion in daily trading volume. The effect of a potential sale on the market would depend on the amount of liquidity available from buyers when the sale occurs.
Bitget raised its estimate of the total amount stolen to $387.5 million on Friday after adding Zcash and TRON transfers that were not included in its initial tally. The exchange said these assets were taken during the same breach rather than in a separate incident.
The exchange has also confirmed that its protection fund is sufficient to cover the losses and said customer balances remain unaffected. Bitcoin withdrawals are expected to resume Sept. 28, followed by Ether on Sept. 29, USDT on Sept. 30 and other tokens on Oct. 2.
