The attacker behind Bitget’s $388 million breach moved about 54 million stolen XRP out of three of the five wallets that initially held the funds. Roughly 49 million XRP, worth about $75 million, remained across the original accounts, while one wallet was reduced to about 5.8 million XRP and two others held only about 23 and 55 XRP.
Why it matters
The movement changes where the stolen XRP sits, not whether it has been sold. The transfers raise the risk of future selling, but the funds had not been confirmed as liquidated. XRP cannot be frozen in an attacker-controlled wallet: the XRP Ledger’s freeze function applies to issued tokens, not its native currency. Platforms may restrict flagged funds after they reach an exchange, but that control does not apply while the XRP remains in private wallets.
The original haul of nearly 103 million XRP was worth around $160 million, equivalent to about 4% of reported daily XRP trading volume. That comparison does not establish how easily the market could absorb a sale, because reported volume is not the same as executable order-book depth.
Market impact
XRP was around $1.47, down about 3% over just more than 24 hours while still up 3% for the week. The price action suggests the transfers are a risk factor for traders, not confirmation that a dump has begun.
The next signals to watch are whether the remaining XRP reaches a labeled exchange address or is swapped on-chain. Either would strengthen the case for near-term selling pressure; the eventual price impact would depend on available buy-side liquidity. Separately, Bitget’s recovery timeline listed Bitcoin withdrawals for Sept. 28, Ethereum for Sept. 29, USDT for Sept. 30 and other tokens for Oct. 2. The exchange said its protection fund covers the loss and customer balances remain unaffected.
Frequently asked questions
-
How much stolen XRP did the attacker move?
About 54 million XRP moved out of three of the five original wallets. Roughly 49 million XRP, worth about $75 million, remained across those accounts.
-
Do the transfers confirm that the attacker sold XRP?
No. The transfers show redistribution between addresses, but the seed does not confirm a sale or liquidation.
-
Why can’t XRP be frozen in the attacker’s wallet?
The XRP Ledger’s freeze function applies to tokens issued on the ledger, not native XRP held in an attacker-controlled wallet.
-
What on-chain activity would strengthen the selling-pressure signal?
A transfer to a labeled exchange address or an on-chain swap would strengthen the case for near-term selling pressure.
-
How did XRP trade as the stolen funds moved?
XRP was around $1.47, down about 3% over just more than 24 hours while remaining up about 3% for the week.
Crypto News