The Bitget hacker has moved about $83 million in stolen XRP from three wallets, while roughly $75 million remains across the original accounts that cannot be frozen on the XRP Ledger.
XRP$1.53-2.48%The attacker behind the Bitget hack has moved about $83 million worth of stolen XRP out of three wallets, leaving roughly $75 million across the original holding accounts. The movement adds a new challenge to recovery efforts because XRP itself cannot be frozen on the XRP Ledger.
The latest transfers follow the $387.5 million Bitget breach disclosed earlier this week. In its latest update, Bitget said the revised figure includes assets on Zcash and TRON that were not part of its initial $351.6 million estimate.
For the full background on how the breach happened, see our earlier coverage: Bitget says $352M exposed in hot-wallet hack, user funds 'safe'. The latest development is now focused on tracking the stolen XRP and limiting where it can move next.
Related: Bitget says $352M Exposed in Hot-Wallet Hack, User Funds 'safe'
Nearly 103 million XRP was taken from Bitget during the September 24 breach and split across five wallets.
By 12:41 UTC on Saturday, two wallets that initially held around 20 million XRP each had been almost emptied, with only about 23 and 55 XRP remaining. A third wallet had fallen to roughly 5.8 million XRP, according to XRP Ledger records.
About 54 million XRP, worth roughly $83 million at the reported price, has now left those original wallets. The transfers indicate that the attacker is spreading the stolen tokens across additional addresses, although the movements alone do not show how much XRP has actually been sold.
The XRP transfers also accelerated overnight. Around 70 million XRP remained across the five original accounts at 04:32 UTC Saturday. About eight hours later, that balance had fallen to roughly 49 million XRP.
The problem for recovery teams is that XRP is the native asset of the XRP Ledger.
The network allows issuers to freeze tokens they create on the ledger, such as certain stablecoins. That control does not extend to XRP itself. As a result, Ripple cannot simply freeze the XRP sitting in wallets controlled by the attacker.
That makes the destination of the stolen funds especially important.
If the attacker sends XRP to a centralized exchange, that platform can identify the transaction and restrict the receiving account. It can prevent withdrawals from that account, but it cannot directly freeze the XRP while it remains in the attacker's own wallet.
The situation is different for stablecoins involved in the breach.
Circle and Tether have frozen roughly $320,000 in USDC and USDT connected to the attack. Their tokens include controls that allow the issuers to blacklist addresses and prevent the assets from being moved.
Bitget also says recovery efforts are already underway with exchanges, blockchain projects and security firms. The exchange has launched a recovery bounty offering up to 5% of successfully frozen or recovered funds to eligible parties whose voluntary efforts directly contribute to the recovery.
The transfers do not appear to be a simple one-time withdrawal.
One attempted transfer of roughly 521,000 XRP failed because the sending wallet did not have enough funds. About an hour later, another wallet sent the same amount to the intended recipient.
These movements suggest the attacker is actively redistributing the stolen XRP across multiple wallets. However, wallet movements alone cannot establish whether the attacker has already sold any of the tokens.
That distinction matters because moving XRP between wallets does not necessarily create immediate selling pressure in the market.
XRP was trading around $1.55 on Saturday, putting the original 103 million XRP haul at roughly $160 million. XRP was down about 1.1% over 24 hours while still holding a weekly gain of around 7.9%.
At that price, the original XRP haul represented roughly 4% of reported daily XRP trading volume. That does not mean the attacker could sell the entire amount at the current price, however. The market impact would depend on available liquidity and the way any potential sale was executed.
Bitget has increased its estimate of the total theft to $387.5 million, covering assets transferred across Ethereum and other EVM networks, the XRP Ledger, Zcash and TRON. The exchange says the higher figure reflects a more complete accounting of the original breach rather than another unauthorized attack.
Bitget has also said its protection fund covers the loss and customer balances remain unaffected. The exchange plans to resume withdrawals in stages, with Bitcoin withdrawals scheduled for September 28, followed by Ether on September 29, USDT on September 30 and other tokens on October 2.
For now, the key question is where the remaining stolen XRP moves next. If it reaches a centralized exchange, recovery teams may have another opportunity to restrict the funds. Until then, the native XRP cannot simply be frozen at the blockchain level.
A whitehat moved 3,832 NFTs from hundreds of wallets into protective custody after concerns surfaced about a Magic Eden vulnerability.
KelpDAO has sued LayerZero Labs and co-founder Bryan Pellegrino in British Columbia over the April 18, 2026 exploit of 116,500 rsETH worth about $292 million.
ETH
Samourai Wallet co-founder Keonne Rodriguez faces another federal prison transfer after FCI McKean deactivated its drug treatment program, putting a potential sentence reduction at risk.
BTC
