On-chain movements and recovery controls following Bitget breach
On-chain movements across the XRP Ledger
Bitget raised its estimate of the overall theft from a recent breach to $387.5 million on Friday after including Zcash and TRON transfers missed in its initial accounting. Nearly 103 million XRP was taken from Bitget on Thursday and divided among five accounts. The hacker moved about $83 million in stolen XRP from three holding wallets, leaving roughly $75 million in accounts that cannot be frozen under XRP Ledger rules.
The XRP transfers accelerated overnight. At 04:32 UTC Saturday, about 70 million tokens remained in the original five accounts. Roughly eight hours later, that balance had fallen to 49 million. By 12:41 UTC Saturday, two accounts that initially held 20 million XRP each had been reduced to about 23 and 55 tokens, according to CoinDesk’s review of XRP Ledger records. A third was down to about 5.8 million XRP.
Some payments followed routes already used by the first wallet. After an attempted transfer of about 521,000 XRP failed because that account lacked sufficient funds, the second sent an identical amount to the intended recipient roughly an hour later. In total, about 54 million XRP has left the original holding accounts.
Protocol limitations and multi-asset freezing mechanics
XRP is the currency built into the XRP Ledger, the blockchain used by payments company Ripple. The network lets companies freeze tokens they issue on it, but that power does not extend to XRP itself. Consequently, Ripple cannot block transactions from wallets controlled by the attacker.
Recovery efforts depend in part on where the money goes next. Exchanges receiving stolen XRP can restrict accounts and prevent withdrawals, but cannot freeze coins while they remain in a wallet controlled by the attacker. Separately, Circle and Tether have frozen about $320,000 in related stablecoins using built-in controls that allow them to blacklist addresses.
Financial recovery and operational timelines
Bitget said its protection fund covers the losses and customer balances remain unaffected. Bitcoin withdrawals are scheduled to resume Sept. 28, followed by ether on Sept. 29, USDT on Sept. 30, and other tokens on Oct. 2.
XRP traded around $1.54 on Saturday, down about 4% over 24 hours while retaining a weekly gain of about 9%, according to CoinGecko. At that price, the original XRP haul was worth roughly $160 million, equivalent to about 4% of the token's $4.4 billion in reported daily trading volume. Transfers show the attacker distributing the stolen funds across more wallets, though records do not reveal how much has been sold.