Hassan Maishera
TL;DR
-
The attacker behind Bitget’s approximately $388 million breach has moved about 54 million stolen XRP, worth roughly $83 million at Saturday’s quoted price.
-
About 49 million XRP, worth approximately $75 million, remained in the five original holding accounts at the latest reported check.
-
XRP itself cannot be frozen through the XRP Ledger’s controls for issued tokens.
-
Circle and Tether have frozen about $320,000 in stablecoins linked to the breach.
The attacker behind Bitget’s crypto exchange breach has moved about $83 million in stolen XRP out of the wallets that first received the funds, complicating efforts to track and recover the assets.
Nearly 103 million XRP was taken in Thursday’s attack and split among five accounts. By 12:41 UTC Saturday, approximately 54 million XRP had left those original accounts, according to XRP Ledger records. Roughly 49 million XRP remained, worth about $75 million at the reported market price.
The transfers show the funds spreading to additional wallets. They do not establish how much XRP, if any, the attacker has sold.
XRP Cannot Be Frozen in an Attacker’s Wallet
The XRP Ledger allows issuers to freeze tokens they create on the network, but that control does not apply to XRP, the ledger’s native asset. Ripple therefore has no built-in mechanism to stop the attacker from moving the stolen XRP while it remains in wallets under their control.
An exchange that receives the funds could restrict the recipient’s account and block withdrawals. Recovery efforts may therefore depend on where the XRP goes next.
Circle and Tether have already frozen about $320,000 in USDC and USDT connected to the breach. Unlike XRP, those stablecoins have issuer controls that can block addresses.
Funds Move as Bitget Updates Loss Estimate
Activity in the original holding accounts accelerated overnight into Saturday. About 70 million XRP remained in the five accounts at 04:32 UTC; roughly eight hours later, that balance had fallen to 49 million XRP.
Two accounts that initially held 20 million XRP each were nearly emptied, with balances of about 23 and 55 XRP. A third held approximately 5.8 million XRP.
Bitget revised its estimate of the overall theft to $387.5 million on Friday after accounting for Zcash and TRON transfers omitted from its first tally. The exchange said the revision reflected assets stolen in the original breach, rather than a second attack.
Bitget says its protection fund covers the loss and customer balances remain unaffected. It scheduled Bitcoin withdrawals to resume on September 28, followed by Ether on September 29, USDT on September 30, and other tokens on October 2.
