Bitget halts XRP withdrawals as 27.63M stolen tokens move

Bitget suspended external XRP withdrawals on Sept. 26 while keeping deposits open. A dated analytics snapshot showed 27.63 million stolen XRP had moved onward from two attacker-controlled accounts by 02:54 UTC on Sept. 26.

Bitget’s public status page listed external XRP withdrawals disabled and deposits enabled at 12:11 UTC on Sept. 26. The exchange posted a phased timetable for reopening withdrawals: Bitcoin on Sept. 28 at 08:00 UTC, Ethereum on Sept. 29, USDT on Sept. 30, and a final phase covering “other tokens,” fiat and peer-to-peer services on Oct. 2 at 08:00 UTC. XRP is not named separately and is therefore included in the Oct. 2 phase.

Bitget reported it had identified and remedied the vulnerability behind the Sept. 24 incident and was carrying out further checks of its withdrawal systems. The company reported trading and deposits would continue and that user balances were not affected.

Analytics data put the total XRP taken in the incident at about 102.98 million tokens. In the Sept. 26 snapshot, 27.63 million XRP had moved out of two of six tracked attacker accounts while 75.35 million XRP remained across those six accounts. The analytics firm described these figures as a dated account-balance snapshot.

The trace followed outgoing transfers through newly created addresses and into THORChain, a cross-chain swap network. Most of the traceable flow the firm followed was swapped into Bitcoin.

The analytics trace does not show whether the stolen XRP was sold on centralized exchange order books or identify the ultimate owners of destination wallets. Transfers between wallets, cross-chain swaps and executed spot trades are separate actions; the transactions followed show movement and swaps but do not establish net sales on exchange order books or the prices obtained.

Bitget revised its platform-wide estimate of assets transferred to attacker-controlled addresses to about $387.5 million, up from $351.6 million. The company attributed the increase to the inclusion of additional affected assets, including Zcash and TRON.

Market data on Sept. 26 showed XRP trading near $1.55 and listed an XRP/USDT market on Bitget. Those price points are a dated snapshot and do not establish a causal link to the breach.

Further timestamped updates to attacker-account balances and Bitget’s platform status on and after Oct. 2 will provide clearer evidence of where the stolen tokens move next and whether external XRP withdrawals have been restored.