The Bitget hack has entered a new phase as a large share of the stolen XRP has left the first set of wallets linked to the attack.
About 54 million XRP, worth roughly $83 million, has moved from wallets that first received XRP from the Bitget breach. The transfers have caught the attention of blockchain analysts because the money has moved to more addresses, which can make the trail harder to follow.
The movement does not prove that the attacker has sold the XRP. Blockchain records show that the coins have moved from one address to another, but they do not by themselves show whether the attacker converted the assets into cash or another cryptocurrency.
The XRP transfers are part of a much larger security incident that affected Bitget on September 24, 2026.
The $387.5 Million Bitget Breach
Bitget first reported losses of about $351.6 million after unauthorized transfers from some of its exchange wallets.
The exchange later revised that figure to approximately $387.5 million. Bitget said the higher figure came from a more complete review of the transfers. It included assets on the Zcash and TRON networks that were not part of the first estimate.
Bitget also said the revised number does not mean that another $35.9 million was stolen after the first report. The additional amount was part of the same incident and came to light after further blockchain analysis.
The breach affected several assets, including XRP, Ethereum, USDT, Zcash, USDC, USDT0, XAUt, BNB, Avalanche and TRON.
Bitget says the affected wallets were part of its centralized exchange system. Its separate self-custody product, Bitget Wallet, was not affected. The exchange also said its cold wallets were safe.
More Than 100 Million XRP Was Stolen
XRP became one of the biggest parts of the attack.
Blockchain data showed that about 103 million XRP was taken during the breach. The coins were first spread across five wallets linked to the attacker.
At the time of the initial theft, the XRP had a value of about $160 million. Since then, a major part of those coins has moved away from the original addresses.
About 54 million XRP, worth around $83 million, has left the five original wallets.
That leaves about 49 million XRP, worth roughly $75 million, across those original accounts based on the latest reported figures.
Two of the wallets that each received about 20 million XRP were almost emptied. One was left with about 23 XRP, while another had about 55 XRP. A third wallet still held about 5.8 million XRP, with other funds spread across additional addresses.
Why the XRP Cannot Simply Be Frozen
One of the biggest problems in this case comes from the design of the XRP Ledger.
XRP is the native asset of the XRP Ledger. It is not an asset issued by Ripple. Because of this, there is no network-level freeze tool that Ripple can use to stop XRP held in a normal wallet.
The XRP Ledger does have freeze features for certain issued tokens. Those controls do not apply to native XRP.
This means Ripple cannot simply identify the attacker’s wallet and lock the stolen XRP. The attacker can move native XRP between self-controlled addresses without a central issuer blocking the transaction.
This feature is important for the wider cryptocurrency system. A decentralized asset can allow users to hold and transfer funds without a central authority. The same feature can also make recovery harder after theft.
Moving the XRP Does Not Mean It Was Sold
The $83 million figure can sound like an enormous sale, but the blockchain evidence does not show that.
The available data shows that about 54 million XRP has moved away from the original wallets. It does not establish that the attacker sold those coins on a trading platform.
This difference matters.
An attacker can move stolen crypto to fresh wallets for many reasons. The goal could be to divide the funds, make the trail harder to follow, prepare for a later swap, or send the assets toward an exchange or another service.
Analysts can watch these transactions on the public blockchain. They can also track whether the XRP reaches known exchange addresses.
For now, the reported transfers show movement of the assets, not confirmed liquidation of the $83 million.
Centralized Exchanges Could Still Stop the Funds
Although XRP itself cannot be frozen on the XRP Ledger, the situation changes if stolen XRP reaches a centralized exchange.
A centralized exchange controls its own customer accounts. If it identifies an address linked to stolen funds, it can restrict the account that receives the assets.
That gives investigators another possible point of intervention.
The same idea has already produced results with some stablecoins linked to the Bitget case. Circle and Tether have frozen roughly $318,000 to $320,000 worth of USDC and USDT associated with the incident, according to reports.
Stablecoins can have issuer-level controls that native XRP does not have. This creates a major difference in how stolen assets can be handled after a hack.
Bitget Says the Attack Is Contained
Bitget says it has identified and fixed the vulnerability behind the incident.
The exchange said the attack involved a critical backend system within its wallet infrastructure. It has worked with outside cybersecurity firms, including Mandiant and SlowMist, as part of the investigation and fund-tracing work.
Bitget also says that no further unauthorized transfers are possible from the affected vulnerability.
The exchange has said that customer account balances remain unaffected. It has also stated that its Protection Fund will cover the financial impact of the incident.
The investigation is not yet complete, however. The company continues to trace the stolen assets and work on recovery efforts.
Withdrawals Are Returning in Stages
The hack also caused Bitget to pause withdrawals as a security measure.
The exchange has since published a phased plan for their return. Bitcoin withdrawals are set to resume on September 28 at 08:00 UTC. Ethereum withdrawals are scheduled for September 29, followed by USDT on September 30. Other tokens, fiat services and peer-to-peer services are scheduled for October 2.
This staged approach gives Bitget more time to check its systems before it restores each group of assets.
The company says trading and deposits remain available and that users do not need to take special action before the scheduled restoration.
The XRP Trail Remains the Key Focus
For the stolen XRP, the next destination of the funds will matter more than the simple fact that they have moved.
About 103 million XRP was taken. Around 54 million XRP worth $83 million has already left the original five wallets, while about 49 million XRP worth $75 million remains in those accounts based on the latest reported snapshot.
Every new transfer gives investigators another address to watch. If the coins reach a centralized exchange, there may be a chance to restrict the related account. If they remain across self-controlled wallets, the options become much more limited.
For now, the blockchain provides a clear record of where the XRP goes, but it does not guarantee that the stolen coins can be recovered.
The Bitget case therefore remains active on two fronts. The exchange must restore confidence in its security systems, while blockchain analysts and investigators continue to follow the stolen assets.
The movement of $83 million in XRP shows that the recovery effort is far from over. The next major transfer could provide more clues about the attacker’s plans and whether any of the stolen funds can eventually return to their rightful owner.
