The individual responsible for the $387.5 million breach at Bitget has successfully transferred approximately $83 million worth of stolen XRP from three wallets. Currently, around $75 million remains in accounts that cannot be frozen due to the XRP Ledger's regulations.
Two wallets have been nearly emptied while a third is still being drained, with about $75 million left across the five original accounts.
On Thursday, nearly 103 million XRP was siphoned from Bitget and dispersed among five separate accounts. As of Saturday at 12:41 UTC, two of these wallets, which initially held 20 million XRP each, had dwindled to approximately 23 and 55 tokens, respectively. A third wallet contained around 5.8 million XRP.
XRP serves as the currency within the XRP Ledger, which is utilized by Ripple, a payments firm. While the network allows organizations to freeze tokens they issue, this capability does not extend to XRP itself, meaning Ripple cannot prevent the attacker from utilizing the stolen coins.
This situation complicates recovery efforts, as it depends on the actions of exchanges that might receive the stolen XRP. While exchanges can restrict accounts associated with the stolen funds, they cannot freeze the coins while they remain under the attacker's control.
Circle and Tether, issuers of the USDC and USDT stablecoins, have already managed to freeze approximately $320,000 linked to this incident. Their tokens are designed with features that enable them to blacklist certain addresses.
The pace of XRP transfers quickened overnight. By 04:32 UTC on Saturday, around 70 million XRP was still in the original five wallets, but this figure dropped to 49 million just eight hours later.
Some of the transactions followed paths previously utilized by the first wallet. After an initial transfer attempt of roughly 521,000 XRP was unsuccessful due to insufficient funds, the second wallet successfully sent the same amount to the intended recipient about an hour later.
To date, around 54 million XRP has been moved from the original holding accounts. These transfers indicate that the attacker is spreading the stolen funds across multiple wallets, although it remains unclear how much of the XRP has been liquidated.
XRP was trading at approximately $1.54 on Saturday, reflecting a 4% decline over the past 24 hours while still showing a weekly increase of about 9%, as per CoinGecko data. At this valuation, the total stolen XRP was worth close to $160 million, roughly 4% of the token's $4.4 billion in reported daily trading volume. The impact of any potential sale on the price will depend on the existing buy orders at that time.
Bitget has revised its estimate of the total theft to $387.5 million after accounting for transfers of Zcash and TRON that were initially overlooked. The exchange clarified that this updated figure pertains to assets stolen during the original breach and not from a subsequent attack.
In the meantime, Bitget confirmed that its protection fund will cover the losses incurred, ensuring that customer balances remain unaffected. Withdrawals are set to resume in phases, starting with Bitcoin on September 28, followed by Ether on September 29, USDT on September 30, and other tokens on October 2.