Wallets linked to the Bitget attacker moved about 54 million XRP, valued near $83 million at the time, away from the original addresses on September 26. The transfers are a concrete follow-up to the September 24 breach, but they do not by themselves show how much XRP was sold or converted. CoinDesk.
Two original wallets that had each held 20 million XRP were almost emptied, while a third was reduced to roughly 5.8 million XRP. CoinDesk reported that about 49 million XRP, worth approximately $75 million, remained across five of the original accounts at 12:41 UTC. Further movements may change that balance.
The episode also highlights a recovery limit specific to native XRP. Ripple does not have an issuer control that can blacklist or reverse XRP at the ledger level. A centralized exchange or another custodian can still restrict an account that receives flagged funds, so investigators will be watching where the transferred assets go rather than assuming that every movement is final.
Bitget separately revised its estimated incident total to approximately $387.5 million from $351.6 million. The exchange said the higher figure reflects Zcash and Tron network assets omitted from the first count, not a second attack or additional unauthorized transfers. Bitget also said it identified the attack path, remediated the vulnerability and engaged Mandiant and SlowMist in the investigation. Bitget security update.
Bitget has said its protection fund will cover the loss and that withdrawals will return in stages. The next useful evidence will be a full incident report, confirmed restrictions at receiving services, additional wallet movements and a completed accounting of customer reimbursement. Until then, the revised loss estimate and the onchain transfers should be treated as separate facts.
Earlier coverage of this event: Bitget pauses withdrawals after reporting $351.6 million wallet breach.