The attacker behind Bitget’s $388 million breach has moved approximately 54 million stolen XRP from three of the five wallets that initially received the funds. The transfers have raised fresh concerns that the stolen tokens could eventually reach the market and increase selling pressure.
Around 103 million XRP was stolen from Bitget and divided among five wallets after the exchange’s wallet infrastructure was compromised. The amount taken has not changed, but the distribution of the funds has. After remaining largely inactive for roughly a day, the stolen XRP has begun moving across additional addresses.
The latest transfers do not prove that a sale has occurred. However, moving stolen tokens between wallets can be an early step before an attempt to liquidate the assets, making the activity something traders are watching closely.
By 12:41 UTC on Saturday, two wallets that each originally contained 20 million XRP had been almost completely emptied, leaving about 23 XRP in one and 55 XRP in the other. A third wallet that held a larger share of the stolen funds had been reduced to around 5.8 million XRP.
Approximately 49 million XRP, worth about $75 million, remained across the five original wallets at that point.
XRP was trading near $1.47, down about 3% over the previous 24 hours but still showing a roughly 3% gain for the week. The relatively contained reaction indicates that traders have so far treated the wallet movements as a potential risk rather than confirmation of an active sell-off.
The stolen XRP was worth around $160 million when the breach occurred, equivalent to roughly 4% of XRP’s reported $4.4 billion in daily trading volume. However, reported volume should not be confused with available order-book liquidity, meaning the market may not be able to absorb a transaction of that size without significant price movement.
Why Ripple Cannot Freeze the Stolen XRP
If stolen XRP reaches a centralized exchange, the platform can identify the funds, restrict the associated account and block withdrawals. Those measures do not apply while the assets remain in a wallet controlled by the attacker.
XRP is the native asset of the XRP Ledger. Its native status means the ledger’s freeze feature, which applies to issued tokens, cannot be used to freeze XRP itself. Ripple therefore does not have a built-in mechanism to stop the attacker from transferring native XRP while it remains in a private wallet.
For now, continued transfers between private addresses would demonstrate movement but not necessarily a liquidation. The potential impact on XRP’s price therefore remains uncertain.
The risk would become more immediate if the stolen XRP appeared in a recognizable exchange wallet or was exchanged for another cryptocurrency or asset on-chain. Even then, the size of any resulting price move would depend on available buying liquidity.
Bitget’s Withdrawal Restart Schedule
The movement of the stolen XRP is occurring as Bitget continues its recovery process following the breach. Bitcoin withdrawals are scheduled to resume on September 28, Ethereum withdrawals on September 29, USDT withdrawals on September 30 and withdrawals for other tokens on October 2.
Bitget has said its protection fund will absorb the losses and that customer balances remain unaffected.
For XRP traders, attention now centers on the roughly $75 million still held across the original wallets and whether those funds remain dormant, are moved to new addresses or eventually reach an exchange where liquidation becomes possible.
