Stablecoin issuers Circle and Tether can freeze stolen tokens with the flip of a switch. Ripple has no equivalent option for XRP, and for Bitget that shortfall currently amounts to roughly $75 million.
The attacker responsible for the $388 million breach at the exchange has now shifted about $83 million worth of stolen XRP out of three holding wallets. A further $75 million remains in accounts that, under the XRP Ledger’s present rules, cannot be frozen.
Two wallets have been nearly drained
Nearly 103 million XRP was pulled from Bitget on Thursday and divided among five accounts. Two of those accounts each began with 20 million XRP. According to XRP Ledger records, by 12:41 UTC on Saturday they held only about 23 and 55 tokens, respectively. A third account had fallen to roughly 5.8 million XRP.
Activity sped up during the night. At 04:32 UTC Saturday, around 70 million tokens still sat in the original five accounts. About eight hours after that, the figure had dropped to 49 million.
Altogether, roughly 54 million XRP has exited the original holding accounts. This shows the attacker is dispersing the funds across a wider set of wallets, but it says nothing about how much has actually been sold.
At least one slip-up by the attacker
Several transfers followed paths the first wallet had already used. In one case, an attempt to send about 521,000 XRP failed because the sending account lacked sufficient funds. Roughly an hour later, the second wallet sent the identical amount to the same recipient.
It was a careless move, but it does nothing to help anyone halt the flow of funds.
Why Ripple can’t pull the plug
XRP is the native currency of the XRP Ledger, the blockchain used by payments company Ripple. Companies that issue their own tokens on the network have the ability to freeze them. That capability does not extend to XRP itself, which leaves Ripple without any built-in mechanism to prevent the attacker from spending the coins.
Stablecoins operate under a different model. USDC and USDT come with controls that allow Circle and Tether to blacklist addresses, and the two firms have already frozen about $320,000 in stablecoins linked to the breach. Measured against a theft of this scale, that sum is a rounding error. It is also the only direct freeze anyone has managed so far.
Recovery hinges on where the coins end up
Should stolen XRP arrive at an exchange, that platform can restrict the receiving account and block withdrawals. It has no power over coins that remain in a wallet under the attacker’s control. As a result, any recovery depends in part on what the hacker does next, rather than on any action Ripple can take.
Could a sell-off hit the price?
On Saturday, XRP was trading at around $1.54, a decline of about 4% over 24 hours but still a gain of roughly 9% for the week.
At that level, the original XRP haul was worth approximately $160 million, or about 4% of the token’s reported $4.4 billion in daily trading volume. The price impact of any sale would depend on how many buy orders are sitting on the books at the moment it occurs.
Bitget says customers are protected
On Friday, Bitget lifted its estimate of the total theft to $387.5 million after accounting for Zcash and TRON transfers it had initially overlooked. The exchange said the revised figure covers assets taken during the original breach and does not indicate a second attack.
Bitget has since confirmed that its protection fund will absorb the loss and that customer balances are unaffected. Withdrawals are being restored in phases.
Bitcoin withdrawals are set to resume on Sept. 28, followed by ether on Sept. 29 and USDT on Sept. 30. All other assets, XRP among them, must wait until Oct. 2. For anyone holding XRP on Bitget, that is the date to watch.