CoinDesk
The attacker behind Bitget’s $387.5 million breach moved about $83 million in stolen XRP from three holding wallets, while roughly $75 million remained across the original accounts. Nearly 103 million XRP was initially split among five accounts; two have been almost emptied, and a third is still being drained.
Why it matters
XRP is native to the XRP Ledger, so Ripple cannot freeze the coins in an attacker-controlled wallet. The ledger’s freeze controls apply to tokens issued on the network, not XRP itself. Exchanges can restrict accounts that receive stolen XRP, but they cannot block transfers while the coins remain in wallets controlled by the attacker.
Circle and Tether have frozen about $320,000 in related USDC and USDT, whose issuer controls allow addresses to be blacklisted. That illustrates the difference between issuer-managed tokens and a native asset with no central freeze mechanism.
Market impact
About 54 million XRP has left the original holding accounts, with transfers accelerating overnight. The movement shows the attacker distributing funds across more wallets, but does not establish how much has been sold. XRP traded around $1.54 on Saturday, down about 4% over 24 hours while still up about 9% for the week. The original XRP haul was worth roughly $160 million at that price; any sale’s market effect would depend on available buy orders.
Bitget revised its total theft estimate to $387.5 million after accounting for Zcash and TRON transfers, saying the change reflected assets from the original breach rather than a new attack. The exchange said its protection fund covers the loss and customer balances are unaffected. Withdrawals were scheduled to resume in stages, starting with Bitcoin on Sept. 28 and ending with other tokens on Oct. 2.
Frequently asked questions
-
Why can’t Ripple freeze the stolen XRP?
XRP is native to the XRP Ledger, and the ledger’s freeze controls apply to issued tokens, not XRP itself. Ripple cannot block transfers from attacker-controlled wallets.
-
What can exchanges do if they receive the stolen XRP?
An exchange can restrict the account that receives the XRP and prevent withdrawals. It cannot freeze the coins while they remain in a wallet controlled by the attacker.
-
How much XRP had left the original holding accounts?
About $83 million in XRP had been moved, and roughly 54 million XRP had left the original holding accounts. The transfers do not establish how much was sold.
-
Did Circle and Tether freeze any funds tied to the breach?
Yes. Circle and Tether froze about $320,000 in related USDC and USDT, which have issuer controls that allow addresses to be blacklisted.
-
What did Bitget say about customer balances and withdrawals?
Bitget said its protection fund covers the loss and customer balances are unaffected. It scheduled withdrawals to resume in stages from Sept. 28 through Oct. 2.
WuBlockchain
Lookonchain
CryptoSlate
WatcherGuru
TheBlock