Bitget Hacker Moves $83M in XRP as Network Rules Limit…

The attacker behind Bitget's $387.5 million security breach has moved more than half of the XRP taken from the exchange, underlining the limits of asset-recovery efforts for a native blockchain asset that cannot be frozen at the protocol level.

About 103 million XRP was stolen in the September 24 attack and initially split across five holding accounts. Roughly 54 million XRP, worth around $83 million at Saturday's prices, has since left those wallets, leaving approximately 49 million XRP valued near $75 million. The transfers show the attacker dispersing funds across additional addresses rather than confirming that any of the tokens were sold.

No protocol-level freeze

XRP's status as the XRP Ledger's native asset is central to the problem. The ledger's freeze function applies only to issued tokens, allowing an issuer to restrict assets it created; official documentation states it does not apply to XRP held in an independent wallet, and Ripple cannot disable the attacker's holdings or prevent transactions between self-custodied accounts. Stablecoins caught in the same breach behaved differently: Circle and Tether froze about $318,000 of USDC and USDT by blacklisting an Ethereum address at the token-contract level.

Centralized exchanges remain the most likely interception point. A venue cannot freeze XRP sitting in an external wallet, but it can suspend an account that receives identified stolen funds and block withdrawals or conversion, making real-time wallet tracking important — and harder as the assets fan out. Blockchain records showed 20 million XRP moving into multiple wallets, followed by further transfers from those holding addresses.

Market impact remains uncertain. The original haul was worth roughly $160 million when XRP traded near $1.54, about 4% of the token's reported $4.4 billion daily volume — a comparison that does not imply a 4% price move, since reported volume is not the same as order-book liquidity. Spreading the tokens across wallets could allow smaller sales over time, routing through different venues, or simply obscure the final destination.

Bitget has raised the confirmed value of assets sent to attacker-controlled addresses to $387.5 million from an initial $351.6 million estimate, after additional Zcash and TRON assets were identified during tracing rather than a second breach. The exchange said the vulnerability has been identified and remediated and that no further unauthorized transfers are possible, with Mandiant and SlowMist assisting the investigation. Its User Protection Fund, valued at more than $464 million when the incident was disclosed, is absorbing the financial impact, and customer balances are unaffected. Withdrawals return in stages: Bitcoin at 08:00 UTC on September 28, Ether on September 29, USDT on September 30, and other tokens, fiat withdrawals and P2P services on October 2.