The attacker behind Bitget’s $387.5 million security breach has moved roughly $83 million worth of stolen XRP out of three of the wallets that initially received the funds, increasing the challenge facing investigators trying to intercept the assets.
About 103 million XRP was stolen from the crypto exchange during the September 24 attack and distributed across five holding accounts. By Saturday, approximately 54 million XRP had left those original wallets, leaving roughly 49 million XRP worth about $75 million at prices at the time.
The movements are significant because XRP, unlike some stablecoins involved in the same breach, cannot be frozen by an issuer while it remains in a self-custodied wallet. That leaves exchanges, custodians and other centralized infrastructure as some of the main points where stolen XRP could potentially be intercepted.
More Than Half of the Stolen XRP Has Left the Original Wallets
The movement accelerated during Saturday. Around 70 million XRP remained across the five original holding accounts at 04:32 UTC. Roughly eight hours later, the combined balance had fallen to about 49 million XRP.
Two wallets that had each received 20 million XRP were almost completely emptied, while another was reduced to around 5.8 million XRP. The transfers spread the stolen tokens across additional addresses, increasing the number of wallets investigators and compliance teams need to track.
Movement between wallets does not prove the XRP has been sold. An attacker can transfer tokens repeatedly between addresses under the same control without interacting with an exchange or generating immediate market sell pressure.
Still, distribution can make recovery more difficult. The farther the funds move from the addresses directly associated with the attack, the more important real-time tracing becomes for exchanges and other platforms that may eventually receive them.
The XRP was part of a broader attack that Bitget has now valued at approximately $387.5 million. The exchange raised its breach estimate from $351.6 million after additional Zcash and TRON transactions were identified during subsequent tracing. Bitget said the revision reflected transfers from the original incident rather than another attack.
Why Ripple Cannot Freeze the Stolen XRP
The difficulty comes from the way the XRP Ledger treats its native currency.
XRP is not an issued token controlled by Ripple. According to the XRP Ledger’s official documentation, freeze functionality applies to issued tokens held through trust lines, not to native XRP itself. No company or individual can use the ledger’s freeze mechanism to immobilize XRP held in an independent account.
That creates a sharp contrast with dollar-linked stablecoins such as USDC and USDT. Their issuers retain administrative controls that can blacklist addresses and prevent affected tokens from being transferred.
Circle and Tether have already frozen roughly $320,000 in stablecoins connected to the Bitget breach. Similar actions are increasingly visible elsewhere on-chain, including recent USDC blacklist activity and cases where Tether froze USDT across identified wallets.
For the stolen XRP, the intervention point is different. A centralized exchange receiving identified funds can restrict the customer account, prevent withdrawals and cooperate with investigators. It cannot remotely disable XRP while the tokens remain in wallets controlled by the attacker.
Bitget Says the Breach Came From Its Backend Wallet Infrastructure
Bitget has also provided more detail about how the September 24 attack occurred.
The exchange said its investigation indicates that an attacker compromised a critical backend system within its wallet infrastructure, spoofed transaction data and triggered the normal authorization process to execute unauthorized transfers. Bitget says a private-key compromise has been ruled out based on the investigation so far.
The company says the vulnerability has since been identified and remediated, with no further unauthorized transfers detected after containment. Cybersecurity firms Mandiant and SlowMist are assisting with forensic work and asset tracing.
Bitget has launched a recovery bounty program under which eligible voluntary actions that directly lead to stolen assets being frozen or recovered can qualify for a reward equal to 5% of the relevant amount.
The exchange has also said customer account balances remain unaffected and that its User Protection Fund will cover the financial impact. The fund was valued at more than $464 million when the incident was first disclosed, making the $387.5 million breach equivalent to a substantial portion of its stated value before recoveries are taken into account.
The XRP Transfers Create a Market Risk, Not Yet a Confirmed Sell-Off
For XRP investors, the distinction between wallet movement and actual liquidation matters.
The original 103 million XRP haul was worth roughly $160 million when XRP was trading near $1.54. That is large enough to attract attention, but comparing it directly with daily trading volume can exaggerate or understate the potential market impact.
What matters is available liquidity at the venues where any sale occurs. A large market order concentrated on a limited number of exchanges could move prices more aggressively than the same amount sold gradually across deeper markets.
The attacker also has an obvious incentive not to dump the entire position at once. Large, identifiable exchange deposits can attract compliance attention and rapid account restrictions. Smaller transfers across multiple addresses and venues may be slower, but they potentially reduce immediate visibility and market impact.
XRP was trading near $1.52 on Sunday, according to CoinGecko, with the token still up roughly 10% over seven days. That suggests the breach has not produced a disorderly market reaction so far. But the remaining stolen position is still large enough that traders are likely to watch identified wallet movements closely.
This is where transparent blockchains create an unusual dynamic. The market can see a large stolen position moving almost in real time, but visibility does not automatically translate into control. Everyone may know where the coins are while nobody has the technical power to stop them.
Withdrawal Restoration Is Bitget’s Next Major Test
For Bitget itself, recovering the stolen XRP is only one part of the post-breach challenge.
The exchange is preparing to restore withdrawals in stages beginning September 28. Bitcoin withdrawals are scheduled to reopen at 08:00 UTC, followed by Ether on September 29 and USDT on September 30. Other tokens, fiat withdrawals and peer-to-peer services are scheduled for October 2.
If those services return on schedule without another security disruption, attention will increasingly move away from immediate containment and toward the longer-term financial and technical consequences of the breach.
The most important unanswered question is not simply how much cryptocurrency was stolen. It is how much Bitget can ultimately recover and how much of the loss the exchange has to absorb after the tracing operation ends.
The attacker’s XRP movements demonstrate why that final number could vary sharply depending on the assets involved. Stablecoins can sometimes be immobilized by issuers. Funds entering centralized exchanges may be intercepted. Native cryptocurrencies held entirely in self-custody offer far fewer intervention points.
The attacker has already moved more than half of the stolen XRP out of its first holding wallets. Until those funds reach infrastructure capable of restricting them, investigators may be able to follow the money without being able to stop it.
Johan Shamshad is a financial markets writer at Dave Finances covering cryptocurrencies, trading platforms, brokers, fintech, financial regulation, and developments across global markets. He previously worked at Gulf News, adding newsroom experience to his coverage of fast-moving financial and digital-asset markets.
His work focuses on identifying market-moving events, company developments, regulatory changes, product launches, and shifts in trading and financial infrastructure.
Johan contributes news and analysis designed to help readers understand not only what happened, but why a development matters and how it may affect the wider financial landscape.