The hacker behind Bitget’s September 24 security breach has moved about $83 million worth of stolen XRP, while the exchange has raised its estimate of the total crypto stolen to $387.5 million. About 103 million XRP was initially taken and divided among five wallets, but more than 54 million XRP has since moved out of those accounts.
Unlike tokens such as USDT and USDC, XRP itself cannot be frozen at the blockchain level. Bitget says its customer balances remain unaffected and its protection fund covers the loss. The exchange has also launched a 5% recovery bounty.
Within 24 hours of the September 24 (UTC) incident: here is our further update as promised. Our investigation with Mandiant and SlowMist is ongoing — thorough forensic analysis takes more than 24 hours, and further findings will be shared as they become available. Three key…
— Gracy Chen @Bitget (@GracyBitget) September 25, 2026
Bitget initially estimated the loss at $351.6 million. The figure was later increased after the exchange traced additional transactions involving assets on the Zcash and TRON networks. Bitget stressed that the additional $35.9 million does not represent a second attack or fresh unauthorised transfers. It is part of a more complete accounting of the original breach.
The exchange said the attack has been contained and no further unauthorised transfers have taken place. Its security teams have also identified the route used by the attacker and found the weakness that allowed some security controls to be bypassed. Bitget said the vulnerability has been fixed.
The stolen funds include XRP, Ethereum, USDT, Zcash, USDC, USDT0, XAUt, BNB, Avalanche and TRX. The investigation is being conducted with cybersecurity firms including Mandiant and SlowMist. Bitget has shared the attacker-linked wallet addresses with the wider crypto industry to help exchanges and blockchain companies identify and restrict the movement of the funds.
The XRP portion of the theft has become particularly difficult to control. XRP Ledger allows issuers to freeze tokens they issue, but that mechanism does not apply to XRP itself. Even Ripple cannot directly freeze XRP held by an attacker.
That means recovery may depend heavily on where the stolen XRP is sent next. If the coins reach a centralised exchange, that platform may be able to restrict the account and stop withdrawals. But the XRP remains beyond direct freeze controls while sitting in an attacker-controlled wallet.
According to an analysis of XRP Ledger records, two wallets that initially held about 20 million XRP each were reduced to only a few dozen tokens. Another wallet still held around 5.8 million XRP. Transfers accelerated over the weekend, with the balance across the original five wallets falling from roughly 70 million XRP to about 49 million XRP within eight hours.
Some of the transfers followed patterns used earlier by the attacker, suggesting that the stolen funds were being distributed among additional wallets. However, the movements do not establish how much XRP has actually been sold.
Bitget has already recovered or frozen some affected assets through cooperation with exchanges, blockchain projects, security companies and other industry participants. Circle and Tether have also frozen around $320,000 in stablecoins linked to the incident.
Source: bitget.com
To encourage further recovery efforts, Bitget has introduced a Recovery Bounty Program. Eligible participants can receive 5% of funds successfully frozen through voluntary efforts, while another 5% bounty can apply when voluntary action directly leads to the recovery of stolen assets. Actions resulting from court orders, law-enforcement requests or other legal procedures are excluded from the programme.
Bitget has also opened a live tracking dashboard, an information-submission portal and an API that allows the industry to monitor the attacker’s wallet holdings. The exchange said investigations and security checks are continuing as it prepares to restore withdrawals.
The incident highlights a broader challenge in crypto security: tracing stolen assets on public blockchains can be relatively transparent, but actually stopping their movement depends heavily on the type of asset, the network involved and whether the funds eventually reach a platform capable of restricting them.
Stay informed with the latest trends in Web3, blockchain innovation, and cybersecurity updates at 3verseTV
You need to login in order to Like
Leave a comment