Bitget Hacker Moves $83M in Stolen XRP Beyond Ripple’s Freeze Reach

The attacker responsible for the Bitget breach has transferred roughly $83 million worth of stolen XRP from three wallets, leaving around $75 million spread across the five accounts that originally received the funds.

Nearly 103 million XRP was taken from Bitget on Thursday and split between five wallets. By 12:41 UTC Saturday, two of those wallets, which had each initially received about 20 million XRP, held only around 23 and 55 tokens, according to CoinDesk’s analysis of XRP Ledger data. A third wallet had fallen to approximately 5.8 million XRP.

The XRP Ledger’s native asset, XRP, differs from tokens such as USDC and USDT in terms of freezing capabilities. Companies that issue tokens on the network can build controls into those assets to freeze or blacklist addresses, but those controls do not apply to XRP itself.

As a result, Ripple cannot directly freeze the XRP held by the attacker or prevent the stolen coins from being transferred. Recovery efforts instead depend partly on where the funds are sent. Cryptocurrency exchanges can restrict accounts that receive stolen XRP and block withdrawals, but they cannot freeze XRP while it remains in an attacker-controlled wallet.

Circle and Tether, the issuers of USDC and USDT, have already frozen roughly $320,000 worth of stablecoins linked to the Bitget breach. Their tokens include mechanisms that allow the companies to blacklist specific addresses.

The movement of the stolen XRP accelerated overnight. Around 04:32 UTC Saturday, approximately 70 million XRP remained in the five original wallets. About eight hours later, the combined balance had dropped to roughly 49 million XRP.

Some of the transfers followed transaction patterns previously used by the attacker. In one instance, a transfer of approximately 521,000 XRP failed because the sending wallet did not contain enough funds. About an hour later, another wallet sent the same amount to the intended destination.

Roughly 54 million XRP has now been transferred out of the original five wallets. The activity indicates that the attacker is spreading the stolen coins across additional addresses, although the blockchain movements do not establish how much XRP, if any, has actually been sold.

XRP was trading near $1.54 on Saturday, down about 4% over the previous 24 hours but still up approximately 9% for the week, according to CoinGecko.

At $1.54, the entire original XRP haul would have been valued at about $160 million. That represents roughly 4% of XRP’s reported $4.4 billion in daily trading volume. The potential market impact of any sale would depend on the amount of available buy-side liquidity when the transaction occurs.

Bitget increased its estimate of the total amount stolen to $387.5 million on Friday after accounting for Zcash and TRON transfers that were not included in its initial calculation. The exchange said the revised figure represented assets taken during the original breach rather than losses from a separate attack.

Bitget has also confirmed that its protection fund is sufficient to cover the losses and that customer balances have not been affected. The exchange said Bitcoin withdrawals are scheduled to resume Sept. 28, followed by Ether on Sept. 29, USDT on Sept. 30 and other tokens on Oct. 2.

About The Author

ctleditor

See author's posts