After a $388 million attack on cryptocurrency exchange Bitget, the hackers behind the incident have moved about $83 million worth of stolen XRP out of three holding wallets, while roughly $75 million remains in accounts that cannot be frozen under the network's current rules.
Nearly 103 million XRP was stolen from Bitget on Thursday and spread across five accounts. According to a review of XRP Ledger records, as of 12:41 UTC on Saturday, two accounts that initially held 20 million XRP each had seen their balances fall to about 23 and 55 tokens respectively. The balance of a third account had dropped to about 5.8 million XRP.
XRP is the currency built into the XRP Ledger, the blockchain used by payments company Ripple. The network allows businesses to freeze tokens they issue on the network, but that authority does not apply to XRP itself. Ripple has no built-in mechanism to stop attackers from spending these XRP. That means efforts to recover the stolen assets depend in part on where the funds flow next. Exchanges that receive the stolen XRP can restrict the recipient's account and block withdrawals. But as long as the XRP remains in wallets controlled by the attackers, exchanges cannot freeze the tokens.
Circle and Tether, the companies behind the dollar-pegged tokens USDC and USDT, have already frozen about $320,000 in stablecoins tied to the attack. The tokens they issue include control mechanisms that allow the companies to blacklist addresses.
The movement of XRP accelerated overnight. As of 04:32 UTC on Saturday, about 70 million tokens remained in the original five accounts. About eight hours later, that balance had fallen to 49 million. Some payments followed routes previously used by the first wallet. After a transfer of about 521,000 XRP failed because that account had insufficient funds, roughly an hour later a second account sent the exact same amount to the intended recipient. About 54 million XRP has now left the original holding accounts.
These transfers show the attackers are spreading the stolen funds across more wallets, but it is not possible to determine from this how much has already been sold. According to CoinGecko data, XRP traded at about $1.54 on Saturday, down about 4% over 24 hours but still up about 9% over the week. At that price, the originally stolen XRP is worth about $160 million, equivalent to roughly 4% of the token's reported $4.4 billion in daily trading volume. How much impact selling these tokens would have on the price depends on the number of buy orders available in the market at the time of the sale.
Bitget on Friday raised its estimate of the total amount stolen to $387.5 million, after including Zcash and TRON transfers that were missed in the initial tally. Bitget said the revised figure reflects assets stolen during the original attack, rather than a separate attack. Meanwhile, the exchange has since confirmed that its protection fund can cover the losses and that customer balances are unaffected. Bitcoin withdrawals are scheduled to resume on September 28, followed by Ethereum withdrawals on September 29, USDT withdrawals on September 30, and withdrawals of other tokens on October 2.
Comments