Bitget hacker moves $83 million in stolen XRP that Ripple cannot freeze

Stolen XRP is being moved out of three Bitget wallets

The attacker behind the Bitget exchange breach has moved about $83 million in stolen XRP out of three holding wallets, leaving roughly $75 million in accounts that cannot be frozen under the rules of the XRP Ledger.

Nearly 103 million XRP was taken from Bitget on Thursday and split across five accounts, according to CoinDesk's review of XRP Ledger records. By 12:41 UTC on Saturday, two accounts that each began with 20 million XRP had been reduced to about 23 tokens and about 55 tokens. A third account was down to about 5.8 million XRP.

The numbers behind the transfers

• Bitget's breach total is reported as $387.5 million, and also described as $388 million in the same report.
• About $83 million in XRP has moved out of three holding wallets.
• About 54 million XRP has now left the original five holding accounts.
• Roughly $75 million remains across those original accounts.
• XRP traded near $1.54 on Saturday, down about 4% over 24 hours and up about 9% over the week, according to CoinGecko.

Why Ripple has no way to block the transfers

XRP is the currency built into the XRP Ledger, the blockchain used by payments company Ripple. A blockchain is a shared record of transactions that no single party controls.

The network lets companies freeze tokens that they issue on it, but that power does not cover XRP itself. Ripple has no built-in way to stop the attacker from spending those coins.

Exchanges that receive stolen XRP can restrict the recipient's account and block withdrawals. They cannot freeze the coins while they sit in a wallet controlled by the attacker.

Circle and Tether froze about $320,000 in stablecoins

Circle and Tether, the companies behind the dollar-linked tokens USDC and USDT, have frozen about $320,000 in stablecoins connected to the breach. A stablecoin is a token designed to hold a steady value, usually near one dollar. These tokens include controls that let their issuers blacklist addresses.

Transfers sped up overnight

At 04:32 UTC on Saturday, about 70 million tokens remained in the original five accounts. About eight hours later, that balance had dropped to 49 million.

Some payments repeated routes already used by the first wallet. After an attempted transfer of about 521,000 XRP failed because that account did not have enough funds, a second account sent the same amount to the intended recipient about an hour later.

The transfers show the attacker spreading the stolen funds across more wallets. They do not show how much of the XRP has been sold.

What Bitget says about customer funds

Bitget said its protection fund will cover the losses and that customer balances are unaffected. The exchange said withdrawals will resume in stages from Sept. 28 through Oct. 2.

How large the haul was compared with normal trading

At a price of about $1.54, the original XRP haul was worth roughly $160 million. That is equal to about 4% of the token's reported $4.4 billion in daily trading volume. How much a sale would move the price depends on the buy orders available when it happens.

What is confirmed and what is still unclear

Confirmed: the XRP was taken from Bitget, the funds were split across five accounts, and transfers out of those accounts were recorded on the XRP Ledger. The stablecoin freezes by Circle and Tether and Bitget's withdrawal timeline were also stated by the parties involved or reported directly.

Unclear: how much of the stolen XRP has been sold, where the funds have ended up, and whether any of the moved coins can be recovered. The report also gives the total breach figure as both $387.5 million and $388 million.

Why this matters for recovery efforts

Because XRP itself cannot be frozen at the network level, recovery depends heavily on what happens when the coins reach an exchange. An exchange can restrict the account that receives them, but it cannot act while the coins stay in a wallet the attacker controls.

Sources

• CoinDesk