The hacker behind the Bitget breach has transferred $83 million in stolen XRP, leaving $75 million in accounts that cannot be frozen.
The hacker behind the Bitget breach, which totaled $387.5 million, has successfully moved around $83 million worth of stolen XRP from three wallets. Approximately $75 million remains in five accounts that cannot be frozen due to the regulations of the XRP Ledger.
Wallets Drained but Not Empty
On Thursday, nearly 103 million XRP was taken from Bitget and distributed across five wallets. As of Saturday, two wallets that each originally held 20 million XRP were nearly depleted, holding just 23 and 55 tokens. A third wallet still has about 5.8 million XRP.
XRP, the currency used on the XRP Ledger, which is operated by Ripple, cannot be frozen by Ripple itself. This complicates recovery efforts, as any return of the stolen funds relies heavily on the actions of exchanges that may receive these coins. Although exchanges can restrict access to accounts tied to the stolen XRP, they cannot freeze the coins while they are still under the hacker's control.
Circle and Tether, the issuers of the USDC and USDT stablecoins, have successfully frozen around $320,000 in assets connected to the breach, utilizing their ability to blacklist certain addresses.
The transfer of XRP accelerated overnight. By Saturday morning, around 70 million XRP remained in the original wallets, but this number dropped to 49 million within just eight hours. The hacker appears to be diversifying the stolen funds across multiple wallets, although it is unclear how much XRP has been converted to cash.
As of Saturday, XRP was trading at approximately $1.54, reflecting a 4% drop within the last 24 hours, yet showing a weekly increase of about 9%. The total stolen XRP is valued at close to $160 million, which represents around 4% of the token's $4.4 billion daily trading volume.
Bitget has updated its estimate of the total theft to $387.5 million, including previously unaccounted transfers of Zcash and TRON. The exchange reassured customers that its protection fund will cover the losses, ensuring that customer balances will not be affected. Withdrawals will begin to resume in phases starting September 28, with Bitcoin, followed by Ether on September 29, USDT on September 30, and other tokens on October 2.
