Bitget Hacker Moves 54 Million XRP (XRP) From Breach Wallets

Bitget Hacker Moves 54M XRP

The attacker who drained roughly 103 million XRP from Bitget has started redistributing the haul, moving about 54 million tokens out of three of the five wallets that held the funds since the exchange breach. On-chain data shows two wallets that each originally carried 20 million XRP were reduced to balances of roughly 23 and 55 tokens by 12:41 UTC on Saturday, while a third wallet that had held a larger share fell to about 5.8 million XRP. Around 49 million XRP tokens, valued near $75 million, remained parked across the original five addresses at that point.

The redistribution matters because shuffling stolen coins into fresh addresses is the on-chain signature that typically precedes a liquidation attempt — without confirming one has actually happened. The mechanics compound the risk: native XRP on the XRP Ledger cannot be frozen, since the ledger's freeze function applies only to tokens issued on top of it, not to XRP itself. Ripple has no built-in mechanism to stop the attacker from spending coins while they sit in wallets under their control, and exchange-side restrictions only bite after flagged deposits reach a platform's books, at which point the receiving venue can restrict the account and block withdrawals. The original haul was worth about $160 million — roughly 4% of XRP's reported $4.4 billion in daily trading volume — though reported volume is not executable order-book depth, and slippage on a large market sale could be steep.

Bitget's own official channels confirm a staged recovery: Bitcoin withdrawals were scheduled to resume Sept. 28, Ethereum on Sept. 29, USDT on Sept. 30 and other tokens on Oct. 2. The exchange says its protection fund covers the loss and that customer balances remain unaffected. For context, we previously reported that Bitget kept XRP withdrawals halted after 27.63 million stolen tokens moved.

ETF Inflows and the Evernorth Vote

While the stolen-coin overhang builds, institutional channels keep absorbing supply in the broader altcoin market. U.S. spot XRP ETFs took in $75.59 million of net inflows during the Sept. 21-25 trading week, lifting cumulative net inflows to approximately $1.79 billion. Bitwise's XRP product led with $58.99 million for the week (about $677 million cumulative), while Franklin Templeton's XRPZ added $16.60 million (roughly $501 million cumulative), and Friday alone produced $22.65 million. The funds held around $1.77 billion in net assets at week's end.

CoinGecko data showed XRP trading near $1.54 within a 24-hour range of $1.50-$1.55 and a market capitalization near $96.9 billion, though the token had slipped toward $1.47 at the latest pullback, and our live spot feed shows a further 3.6% decline over the past 24 hours. Analysts flag $1.55 as the immediate resistance, with Peter Brandt's longer-term chart case pointing to $5.40. Korean demand also remains notable: XRP topped Upbit's weekly turnover at 2.45 trillion won.

The calendar adds a second catalyst. Armada Acquisition Corp. II shareholders vote Sept. 30 on the combination with Evernorth Holdings, whose Form S-4 the SEC declared effective on Aug. 27. Evernorth controls or has commitments covering about 473.28 million XRP and plans to list on Nasdaq under the XRPN ticker, operating an actively managed XRP treasury deployed through ledger infrastructure. An SEC filing shows Evernorth signed a note purchase agreement on Sept. 11 with NH Investment & Securities covering $30 million of 4% convertible senior payment-in-kind notes due 2031 — financing that closes only when the merger does, expected in the fourth quarter. The deal, originally sized above $1 billion with backing from Ripple, SBI Holdings, Pantera Capital and Kraken, was amended in August after XRP fell below the $2.36 reference price; investors representing more than 95% of committed capital agreed to the revised terms.

Supply Overhang Meets Structured Demand

Our reading of the two flows frames the near-term setup for Ripple's cross-border settlement asset. On one side, roughly $75 million in stolen XRP sits unplaced, and any surfacing at a labeled exchange address would materially strengthen the sell-pressure case; on the other, ETF demand keeps accruing but the treasury bid is not yet fully funded — the SEC filing itself states that issuance and payment of Evernorth's $30 million in notes remain conditional on the business combination closing. With spot price down 3.6% over the past 24 hours, the market is pricing the hacker's transfers as risk, not as a confirmed dump, and the $1.55 level now doubles as the test of which flow dominates.