Bitget Attacker Moves 54M XRP, but No Sale Is Confirmed

About 54 million XRP, worth roughly $83 million at the reported price, has left the five wallets that received stolen funds from Bitget. But the transfers still don’t show that the attacker has sold the tokens or put them onto an exchange.

That distinction matters. Moving XRP between wallets can prepare stolen funds for a sale without creating immediate selling pressure. The risk becomes more concrete if the tokens reach an exchange.

The original wallets were largely drained

The attacker took nearly 103 million XRP during the September 24 breach, which Bitget split across five accounts. By 12:41 UTC on Saturday, two wallets that began with about 20 million XRP each held only 23 and 55 XRP. A third was down to about 5.8 million, according to CoinDesk’s review of XRP Ledger records.

The combined balance across all five original accounts fell from about 70 million XRP at 04:32 UTC Saturday to roughly 49 million about eight hours later. That pace suggests the transfers were still under way.

Not every transfer went through. One attempt to send about 521,000 XRP failed because the wallet lacked sufficient funds. Roughly an hour later, a second wallet sent the same amount to the intended recipient. That repeated route makes the second payment easier to connect, but it doesn’t identify the recipient as an exchange or another public service.

Distribution is not a confirmed sale

The available reporting shows the stolen XRP spreading across more wallets. It doesn’t reveal how much, if any, has been sold. No exchange deposit address or confirmed transaction with a labelled destination has been reported in the sources reviewed for this story.

That leaves three possibilities open. The XRP could have moved through attacker-controlled wallets, been sold or swapped, or reached a service that the available reporting hasn’t identified. The evidence doesn’t settle which has happened.

The lack of a confirmed sale doesn’t remove the risk. The original 103 million XRP haul was worth about $160 million at the reported price. That was roughly 4% of XRP’s $4.4 billion in reported daily trading volume, although reported volume isn’t the same as the number of buy orders available at the moment of a sale.

Earlier reporting on XRP inflows to Binance found that exchange inflows and reserves weren’t moving in a way that confirmed broad selling pressure. The Bitget transfers are different because they come from wallets linked to a theft, but the same distinction applies: reaching a wallet isn’t the same as reaching a seller’s order book.

Ripple can’t freeze native XRP

The XRP Ledger gives issuers control over certain tokens created on the network, including the ability to blacklist addresses. That authority doesn’t extend to native XRP. Ripple therefore can’t freeze the tokens while they remain in wallets controlled by the attacker.

A centralized exchange can restrict an account and block withdrawals if it receives and identifies the stolen XRP. That option only becomes available once the funds reach the platform’s books. An exchange cannot freeze the tokens while the attacker still controls the wallet.

The contrast with dollar-linked tokens is clear. Circle and Tether have already frozen about $320,000 in USDC and USDT connected to the breach because their systems allow issuers to blacklist addresses. Native XRP doesn’t have that issuer-level control.

Selling pressure depends on the next destination

The 54 million XRP movement is substantial, but calling it fresh selling pressure goes beyond the available evidence. The transfers show active distribution, not a completed sale.

An exchange deposit would be the next important signal because it would bring the stolen tokens within the exchange’s account controls. So far, the strongest supported conclusion is simpler: the Bitget attacker has moved a large portion of the original haul out of five wallets, while the final destination and any sale remain unconfirmed.