Bitget breach revised to $387.5 million as hacker moves $83 million in stolen XRP

Bitget now puts its Sept. 24 breach at $387.5 million, not the $351.6 million first announced — and CoinDesk reports the thief has since moved roughly $83 million of the stolen XRP out of the wallets holding it. XRP has no override that lets any company freeze it, Ripple included, which is why the movement could not be stopped.

Key points

• Bitget's own count was incomplete on day one. CoinDesk (Shaurya Malwa, 8:56 a.m. EDT Sept. 26) reports the exchange had missed transfers on the Zcash and TRON networks in its first tally; finding them on Friday pushed the total from $351.6 million to $387.5 million. This is the third dated figure CoinDesk has reported since Thursday's disclosure, and it turns on those Friday and Saturday developments rather than repeating Thursday's news.
• Five accounts absorbed the XRP piece of the theft: close to 103 million tokens taken in Thursday's breach, CoinDesk reports. Valuing that haul at Saturday's price — XRP traded around $1.54 that day, down roughly 4% on the day despite a 9% gain for the week — puts it at about $160 million, which CoinDesk sets against the $4.4 billion in XRP the outlet says changed hands globally that day: the theft is a small slice of that, around 4%.
• Two wallets are effectively empty now: 23 XRP left in one, 55 in another, out of 20 million each at the start, per CoinDesk's own ledger review timestamped 12:41 UTC Saturday. A third has 5.8 million of its original balance left. Zoom out from those three to all five wallets together and two different windows tell two different stories. Narrowly, in the eight hours after 04:32 UTC Saturday, the combined balance slid from about 70 million XRP to about 49 million, a 21-million-token move. Across the whole span since Thursday's theft, the slide is bigger: the five wallets held 103 million XRP to start and hold 49 million now, a cumulative outflow of about 54 million XRP — worth roughly $83 million at Saturday's price, the number in CoinDesk's headline — with the remaining 49 million, about $75 million, still there.
• The breach surfaced Thursday when Bitget CEO Gracy Chen said the exchange had caught "unauthorized transfers from some of our hot wallets," per CoinDesk's Sept. 24 report (Aoyon Ashraf and Nikhilesh De, 5:59 p.m. EDT). By then, the same report says, Arkham Intelligence analyst Emmett Gallic had already flagged unusual activity across three hot wallets and one cold wallet, ahead of Bitget's own statement.
• One wallet did lose money it couldn't spend: Etherscan's label for it is Bitget Exploiter 8, and per CoinDesk's Sept. 25 report (Oliver Knight), Circle put it on its blacklist Friday at 05:00 UTC, with Tether adding its own freeze shortly after — together, about $318,000 across 218,023 USDT and 99,990 USDC. That report puts everything else the thief holds beyond those two frozen sums, more than 63,000 ETH among it, entirely out of any issuer's reach.
• Bitget says its customers won't carry the loss. CEO Chen told CoinDesk on Thursday its protection fund holds more than $464 million, per the outlet's Sept. 24 report, and the exchange has laid out a phased return of withdrawals — bitcoin first on Sept. 28, ether the day after, USDT on Sept. 30, everything else by Oct. 2, per CoinDesk's Sept. 26 report. Bitget's own support page confirms a window running 08:00 UTC Sept. 28 through full restoration by 08:00 UTC Oct. 2, though that page gives no per-asset breakdown of its own.

Why it matters

The XRP Ledger was built so that only assets a company issues on top of it — stablecoins, mainly — carry a freeze switch; the base currency moves without anyone's permission by design, a feature that protects ordinary holders for years and now, in this case, protects a thief instead. That is the whole reason Circle and Tether could block a $318,000 sliver of stolen stablecoins while the much larger XRP and ether holdings kept moving untouched. Bitget's total climbed to $387.5 million from $351.6 million only because the exchange itself found transfers it had missed the first time; whether it climbs again has not been reported.

This is an AI-written summary of the sources credited above and linked in the text, read and edited by Nicholas before publishing. The facts and the quoted phrase belong to those sources; the wording is ours. Read the original.