Image Credit: Shutterstock
Key Takeaways
- The Bitget hacker moved $83 million of stolen XRP out of holding wallets, leaving about $75 million that can’t be frozen under XRP Ledger rules
- Unlike XRP, Circle and Tether froze roughly $320,000 in USDC and USDT tied to the breach using their issuer-level blacklisting controls
- Bitget raised its total breach estimate to $387.5 million and plans staged withdrawal resumptions from Sept. 28 through Oct. 2
The attacker behind crypto exchange Bitget’s $387.5 million breach has moved about $83 million worth of stolen XRP out of three holding wallets, leaving roughly $75 million in accounts that cannot be frozen under the XRP Ledger’s existing rules.
The transfers highlight a structural limit on how far token issuers can go to recover stolen funds once an attacker controls the wallets holding them.
A Structural Gap in XRP’s Freeze Controls
Nearly 103 million XRP was taken from Bitget on Thursday and split among five accounts. By 12:41 UTC Saturday, two accounts that initially held 20 million XRP each had been reduced to about 23 and 55 tokens respectively, according to a review of XRP Ledger records. A third account was down to roughly 5.8 million XRP.
XRP is the native currency of the XRP Ledger, the blockchain operated by payments company Ripple. The network allows companies to freeze tokens they themselves issue on it, but that capability does not extend to XRP itself. Ripple has no built-in mechanism to block the attacker from spending the stolen coins directly.
That gap leaves recovery efforts dependent largely on where the stolen funds move next. An exchange that receives stolen XRP into a customer account can restrict that account and block withdrawals. No party, however, can freeze the coins while they remain in a wallet the attacker directly controls.
Stablecoins Tied to the Breach Have Already Been Frozen
Circle and Tether, the issuers behind dollar-linked tokens USDC and USDT, have already frozen about $320,000 in stablecoins connected to the breach. Both companies’ tokens include built-in blacklisting controls that let the issuers restrict specific addresses, a capability XRP itself lacks.
That distinction underscores a broader difference in how various crypto assets handle stolen-fund recovery.
Centralized stablecoins built with issuer-level freeze controls can act quickly to limit an attacker’s ability to cash out through regulated on-ramps. Assets like XRP, designed without that kind of centralized intervention capability, leave recovery efforts dependent entirely on downstream exchanges catching and freezing tainted funds after the fact.
Transfers Accelerated Overnight
The pace of XRP transfers picked up significantly overnight. At 04:32 UTC Saturday, about 70 million tokens remained across the original five accounts. Roughly eight hours later, that balance had fallen to 49 million.
Some transfers followed patterns already established by earlier movements. After an attempted transfer of about 521,000 XRP failed due to insufficient funds in that account, a second account sent an identical amount to the same intended recipient roughly an hour later. This suggests a degree of coordination or scripted repetition behind the fund movements.
About 54 million XRP has now left the original holding accounts in total. The transfers show the attacker distributing stolen funds across a growing number of wallets, though they do not by themselves reveal how much of the total has already been sold or converted to other assets.
Market Impact Remains Limited So Far
XRP traded around $1.54 on Saturday, down about 4% over 24 hours while still holding a weekly gain of roughly 9%, according to CoinGecko data. At that price, the original XRP haul was worth approximately $160 million, equivalent to about 4% of the token’s $4.4 billion in reported daily trading volume.
How much any eventual sale would move XRP’s price depends on the depth of buy orders available in the market at the time the attacker chooses to sell.
Bitget raised its overall theft estimate to $387.5 million on Friday after including Zcash and Tron transfers it said were missed in its initial accounting, characterizing the revision as a more complete accounting of the original breach rather than evidence of a separate attack.
The exchange said its protection fund will cover the losses and that customer balances remain unaffected, with withdrawals scheduled to resume in stages: Bitcoin on Sept. 28, Ether on Sept. 29, USDT on Sept. 30 and other tokens on Oct. 2.
