Bitget Hacker Moves $83M in Stolen XRP (XRP) From Holding Wallets

$83M in Stolen XRP on the Move

The hacker behind last week's breach of crypto exchange Bitget has moved roughly $83 million in stolen XRP (XRP) out of the holding accounts where the funds were parked, on-chain records show. Nearly 103 million XRP was taken from the exchange on Thursday and divided across five wallets. Our review of XRP Ledger records shows that by 12:41 UTC on Saturday, two accounts that initially held 20 million XRP each had been stripped down to about 23 and 55 tokens respectively, while a third was down to roughly 5.8 million XRP. In total, approximately 54 million XRP — about $83 million at prevailing prices — has left the original wallets, leaving around $75 million still under the attacker's control.

The pace of the transfers accelerated sharply overnight. On-chain data shows about 70 million tokens remained in the five accounts at 04:32 UTC on Saturday; roughly eight hours later, that balance had fallen to 49 million. The pattern points to deliberate distribution rather than a single liquidation. After an attempted transfer of about 521,000 XRP failed because the sending account lacked sufficient funds, a second wallet sent an identical amount to the same recipient roughly an hour later — evidence the attacker is reusing established routes. The activity spreads stolen coins across a widening set of addresses, a structure consistent with derivation-based self-custody such as an HD wallet, where many receiving addresses stem from a single seed. The transfers do not reveal how much, if any, has been sold. Bitget separately raised its estimate of the total breach to $387.5 million on Friday after including Zcash and TRON transfers omitted from its initial accounting, a figure we examined in our earlier breakdown of the $387.5 million breach losses.

No Freeze Switch for XRP on XRPL

The outflow exposes a structural gap in recovery options. The XRP Ledger, a layer-1 network closely associated with payments company Ripple, lets issuers freeze tokens they create on it — but that authority does not extend to XRP itself, the network's native currency. Ripple therefore has no built-in way to block the attacker from spending the stolen coins. An exchange receiving stolen XRP can restrict the recipient's account and block withdrawals, yet it cannot freeze the tokens while they remain in a wallet the attacker controls. Recovery efforts depend, in large part, on where the money moves next.

Stablecoin issuers hold sharper tools. Circle and Tether, the companies behind USDC and USDT, have frozen about $320,000 in stablecoins connected to the breach, using blacklist controls embedded directly in their tokens. Market impact has so far been contained: XRP traded near $1.54 on Saturday, down about 4% over 24 hours while retaining a roughly 9% weekly gain, echoing the resilience of the broader altcoin market. At that price, the original haul was worth around $160 million — approximately 4% of the token's $4.4 billion in reported daily trading volume. How much a large sale would move the price depends on the buy orders available at the moment it happens; thin order books can produce significant slippage on disposals of this size. Bitget's official statement confirms its protection fund will cover the losses and that customer balances are unaffected. Withdrawal resumption is staged: Bitcoin on Sept. 28, ether on Sept. 29, USDT on Sept. 30 and remaining tokens on Oct. 2.

Recovery Hinges on Exchange Screening

Our reading of the ledger data is that more than half of the stolen XRP was redistributed within roughly 24 hours of the breach estimate being revised upward — and the only effective freezes so far came from stablecoin issuers with embedded blacklist powers, not from the XRP Ledger itself. That asymmetry defines the recovery path: exchanges that receive the stolen coins can restrict deposits and withdrawals, so destination screening at major venues is where any clawback will be decided. Unless intercepted, the remaining ~$75 million is likely to keep fragmenting across fresh addresses in the days ahead. For readers tracking the asset through this episode, our guide on where and how to buy XRP covers venue selection and custody basics.