Bitget Keeps XRP (XRP) Withdrawals Halted After 27.63 Million Stolen Tokens Move

Bitget's XRP Withdrawals Stay Frozen

Withdrawals of XRP (XRP), Ripple's cross-border settlement asset, remain suspended on Bitget nearly a week after the exchange disclosed a security breach — and the stolen tokens are now moving on-chain. The exchange's own status page showed, as of 12:11 UTC on September 26, that XRP deposits were still being accepted while external withdrawals stayed blocked. Bitget's published recovery schedule stages the restart asset by asset: Bitcoin withdrawals were set to resume September 28, ETH on September 29 and USDT on September 30, with “other tokens,” fiat channels and P2P services following on October 2 at 08:00 UTC. XRP is not itemized separately anywhere in that calendar, which places it in the final tranche. The company maintains it has identified and patched the underlying vulnerability, that customer balances were untouched, and that trading and deposits never stopped. On-chain data sharpens the picture: analytics tracing puts the stolen XRP total at roughly 102.98 million tokens, and by 02:54 UTC on September 26, 27.63 million of those — about 27% of the haul — had already moved out of two of the six attacker wallets under surveillance, leaving 75.35 million still parked in place. Part of the moved supply appears to have been exchanged into Bitcoin through THORChain, one of the cross-chain bridges built for asset swaps, though the flow shows no sign of spot-market selling on centralized order books yet. Bitget also lifted its aggregate loss estimate on September 25 to a range of $351.6 million to $387.5 million after booking Zcash and TRON assets into the tally — an accounting revision, the exchange stressed, not a newly discovered outflow. The episode is a blunt reminder that whoever controls a private key controls the funds. For traders weighing alternate venues in the meantime, our guide to where and how to buy XRP walks through the options.

XRPL Ships Emergency xrpld 3.4.1

The XRP Ledger's own infrastructure is going through a quieter but equally instructive stress test. xrpld 3.4.1 — the reference server implementation that validators and node operators run to participate in the network — was released on September 25, and XRPL's official documentation describes it as an emergency release addressing a security-sensitive defect. XRP Ledger Operations, the group that publishes the network's operational guidance, urged validators and node operators to upgrade as soon as possible, saying there has been no mainnet impact and no loss of funds, in its announcement on X. Alongside stability and security fixes, the version carries fixBatchV1_2, a corrective amendment for the Batch feature, which lets up to eight transactions execute as a single atomic unit under all-or-nothing semantics — the mechanism that prevents an asset delivery from completing while its payment fails. The feature's short history is a study in caution: a serious flaw discovered before mainnet activation led to Batch being disabled in xrpld 3.1.1 back in February, a rewritten BatchV1_1 shipped with 3.3.0 on August 6, and a newly confirmed issue in that replacement triggered this week's fix. XRPL activates amendments only when validator support holds at 80% or above for two consecutive weeks, and BatchV1_1 briefly slipped under that bar, resetting its countdown — it re-secured backing from 30 of 35 trusted validators on September 25 and entered a fresh two-week window. fixBatchV1_2 already commands the required support and, if it is sustained, activates around October 9; from that moment, any server still on an older build will lose synchronization with the network, making the pre-activation upgrade mandatory. Because the defect touches security, the 3.4.1 source code is being withheld for now, with a post-incident technical report promised once the amendment goes live.

Two Remediation Clocks Run Into October

Read together, the two stories describe the same discipline applied at different layers of the stack: centralized custody rebuilding trust through a published withdrawal calendar, and a decentralized ledger repairing code through validator voting. The primary records — Bitget's status page and XRPL Operations' promised post-activation report — will become the definitive evidence in both cases, and our XRP coverage hub will track them. Demand has not flinched: Bitwise led $22.65 million in XRP spot ETF inflows on September 25, and technicians still reference Peter Brandt's $5.40 long-term target even as the wider altcoin market digests the week's security headlines. Our reading: the remaining 75.35 million stolen tokens, Bitget's October 2 restart and the October 9 activation are the three checkpoints that decide whether this stays a cleanup story or becomes a fresh shock.