The attacker behind Bitget’s $388 million news driver has moved about 54 million stolen XRP out of three of the five wallets that originally held the funds. The redistribution raises the odds of future selling pressure on XRP.
Nearly 103 million XRP was taken from Bitget and split across five accounts when the exchange’s wallet infrastructure was breached. What has changed since is not the size of the theft but its distribution, but coins that sat static for roughly a day are now spreading across new addresses.
So, what will happen next? This on-chain signature that typically precedes a liquidation attempt, though it does not confirm one has happened.
Earn $50 and Enter $300K Prize Draw on EdgeX
Why Does This News Increase XRP Sell-Side Risk?
| Wallet | Initial Holding | Balance as of Saturday |
| Wallet 1 | ~20 million XRP | ~23 XRP |
| Wallet 2 | ~20 million XRP | ~55 XRP |
| Wallet 3 | Unspecified share of 103M total | ~5.8 million XRP |
| Wallets 4 & 5 (combined) | Remaining share of 103M total | ~43 million XRP (implied) |
Two wallets that each initially held 20 million XRP were reduced to about 23 XRP and 55 XRP, respectively, by 12:41 UTC on Saturday. A third wallet, which had held a larger share of the haul, was down to about 5.8 million XRP after the same window. Roughly 49 million XRP, worth about $75 million, remained across the original five accounts at this point.
XRP is hovering around $1.47 today, down about 3% just over 24 hours, while still holding a weekly gain of 3%. The token has not cratered on the news, which is itself informative: markets are pricing in the transfer as a risk factor, not as confirmation of a dump.
The original XRP haul was worth around $160 million, equivalent to about 4% of XRP’s reported $4.4 billion in daily trading volume. That comparison sounds reassuring on its surface, but reported volume is not executable order-book depth.
An exchange that receives flagged XRP can restrict the recipient account and block withdrawals once the deposit is identified. What it cannot do is freeze the coins while they remain in a wallet that the attacker still controls. This restriction only bites after the funds move onto a platform’s books.
Trade XRP on Bybit and Get a Chance to Win Our $1,000 USDT Airdrop
Native XRP Can’t Be Frozen in the Attacker’s Wallet
XRP is the native currency of the XRP Ledger, and that status is the crux of the recovery news problem. The ledger’s freeze function applies to tokens issued on top of it, not to XRP itself, which means Ripple has no built-in mechanism to stop the attacker from spending native XRP for as long as it sits in a wallet under their control.
If the remaining XRP stays parked across private wallets, the record so far confirms movement without confirming a sale, and the price impact case remains theoretical. If instead the tokens surface at a labeled exchange address or get swapped into another asset on-chain, the case for imminent sell pressure gets substantially stronger, and how much the price actually moves will hinge on the buy-side liquidity available at that moment.
Bitget’s own recovery timeline runs in parallel: Bitcoin withdrawals are scheduled to resume Sept. 28, Ethereum on Sept. 29, USDT on Sept. 30, and other tokens on Oct. 2. Bitget has said its protection fund covers the loss and that customer balances remain unaffected, leaving the open question not about exchange solvency but about where the $75 million in still-parked XRP ultimately lands.
Discover: The Best Token Presales