Circle and Tether could hit a switch and freeze stolen stablecoins. Ripple can’t do the same for XRP. Right now, that gap is costing Bitget about $75 million.
The attacker behind the exchange’s $388 million breach has moved about $83 million in stolen XRP out of three holding wallets. Another $75 million is still sitting in accounts that can’t be frozen under the XRP Ledger’s current rules.
Two wallets are almost empty
On Thursday, nearly 103 million XRP was taken from Bitget and split across five accounts. Two of them started with 20 million XRP each. XRP Ledger records show that by 12:41 UTC Saturday, those two held about 23 and 55 tokens. A third was down to about 5.8 million XRP.
The pace picked up overnight. At 04:32 UTC Saturday, about 70 million tokens were still in the original five accounts. Roughly eight hours later, 49 million were left.
In all, about 54 million XRP has left the original holding accounts. That tells you the attacker is spreading the funds across more wallets. It doesn’t tell you how much has been sold.
The attacker made at least one mistake
Some of the transfers reused routes the first wallet had already taken. One attempt to send about 521,000 XRP failed because the sending account didn’t have enough funds. About an hour later, the second wallet sent that exact amount to the same recipient.
That’s sloppy. But it doesn’t help anyone stop the money.
Why Ripple has no kill switch here
XRP is the native currency of the XRP Ledger, the blockchain payments company Ripple uses. Companies that issue their own tokens on the network can freeze them. That power doesn’t cover XRP itself, so Ripple has no built-in way to stop the attacker from spending those coins.
Stablecoins work differently. USDC and USDT include controls that let Circle and Tether blacklist addresses, and the two companies have already frozen about $320,000 in stablecoins tied to the breach. Against a haul this size, that’s a rounding error. It’s also the only direct freeze anyone has pulled off so far.
Recovery now depends on where the coins land
If stolen XRP reaches an exchange, that exchange can restrict the account that received it and block withdrawals. It can’t touch coins that stay in a wallet the attacker controls. So recovery depends partly on the hacker’s next move, not on anything Ripple can do.
Could a sale move the price?
XRP traded around $1.54 on Saturday. That’s down about 4% over 24 hours but still up about 9% on the week.
At that price, the original XRP haul was worth roughly $160 million. That’s about 4% of the token’s $4.4 billion in reported daily trading volume. How much a sale would move the price depends on how many buy orders are on the books when it happens.
Bitget says customers are covered
Bitget raised its estimate of the total theft to $387.5 million on Friday after counting Zcash and TRON transfers it missed the first time. The exchange said the higher number reflects assets taken in the original breach, not a second attack.
Bitget has since confirmed its protection fund covers the loss and customer balances aren’t affected. It’s reopening withdrawals in stages.
Bitcoin withdrawals are scheduled to resume Sept. 28, ether on Sept. 29 and USDT on Sept. 30. Everything else, XRP included, has to wait until Oct. 2. If you hold XRP on Bitget, that’s the date to mark.
