The attacker behind Bitget’s $387.5 million security breach has moved about $83 million worth of stolen XRP from three wallets, leaving roughly $75 million across the five original holding accounts. The transfers highlight a key limitation of the XRP Ledger: while some tokens issued on the network can be frozen, the ledger’s native XRP cannot be blocked by Ripple or another central authority.
According to CoinDesk, nearly 103 million XRP taken from Bitget on Thursday was initially divided among five accounts. By 12:41 UTC on Saturday, two wallets that had each received 20 million XRP held only about 23 and 55 tokens. A third wallet still contained approximately 5.8 million XRP but was also being drained.
The movements mean about 54 million XRP has now left the original group of wallets, while around 49 million XRP remains there. The stolen coins were being distributed across additional wallets, although the transfers do not show whether the attacker has sold any of the XRP.
Why the XRP transfers are difficult to stop
The XRP Ledger is the blockchain on which XRP operates. Its rules allow issuers of tokens created on the network to include controls that can freeze or blacklist those assets. That mechanism applies to issued tokens, such as certain stablecoins, but not to XRP itself, which is the network’s native currency.
As a result, Ripple cannot simply freeze the XRP held by the attacker. The company has no built-in ability to prevent transactions involving those coins while they remain in wallets controlled by the hacker.
The recovery effort therefore depends partly on where the stolen funds are sent. If the XRP reaches a cryptocurrency exchange, that platform may be able to identify and restrict the receiving account, preventing withdrawals. It cannot freeze the coins beforehand while they remain in the attacker’s own wallet.
Stablecoin issuers have used a different approach in response to related transfers. Circle and Tether, the companies behind USDC and USDT, have frozen about $320,000 in connected stablecoins. Those dollar-linked tokens include controls that allow their issuers to blacklist particular addresses.
Transfers accelerate as wallets are emptied
The movement of XRP increased over the course of Saturday. At 04:32 UTC, approximately 70 million tokens remained across the five original accounts. About eight hours later, the combined balance had declined to 49 million XRP.
Some of the transactions followed patterns used earlier by the attacker. In one case, a transfer of about 521,000 XRP failed because the sending account did not have enough funds. Roughly an hour later, another of the compromised accounts sent the same amount to the intended recipient.
The attacker’s actions show the stolen XRP being spread across more wallets. They do not establish whether the funds have been exchanged for other assets or sold into the market. The value of any eventual sale would depend on the available buy orders at the time.
Bitget revised its estimate of the total breach to $387.5 million on Friday. The updated figure included transfers involving Zcash and TRON that had not been included in the exchange’s initial accounting. Bitget said the higher estimate represented assets taken in the original breach, rather than a second attack.
Bitget says customers will be protected
Bitget has said its protection fund will cover the losses and that customer balances are unaffected. The exchange also set out a staged timetable for restoring withdrawals: Bitcoin withdrawals were scheduled to resume on Sept. 28, followed by ether on Sept. 29, USDT on Sept. 30 and other tokens on Oct. 2.
The incident illustrates the difference between assets whose issuers retain administrative controls and a blockchain’s native currency. Centralized exchanges may be able to intervene after stolen coins arrive on their platforms, while transactions involving native XRP cannot be stopped through an issuer freeze.
XRP market picture
Moneyiar market data recorded XRP at $1.5521388078 at 22:03 on Sept. 25, 2026, with a 24-hour gain of 0.85% and a seven-day increase of 10.72%. The figures are Moneyiar data at that time.
CoinDesk reported XRP trading at about $1.54 on Saturday, down roughly 4% over 24 hours while still holding a weekly gain of about 9%. Based on that price, the original XRP haul was worth approximately $160 million. CoinDesk compared that amount with reported daily XRP trading volume of $4.4 billion, while noting that the market impact of a sale would depend on the buy orders available when transactions occur.
