The attacker behind this week's Bitget breach has moved about $83 million worth of stolen XRP out of the wallets where it was first parked, taking advantage of the fact that the XRP Ledger's native token cannot be frozen, CoinDesk reported Saturday. Bitget now puts the total loss at $387.5 million, up from its first estimate.

What Happened

Nearly 103 million XRP was taken from Bitget Thursday and divided among five accounts, according to CoinDesk's review of on-chain data. Transfers out of those accounts sped up overnight: at 04:32 UTC Saturday about 70 million tokens remained, and eight hours later only about 49 million did.

By 12:41 UTC, two accounts that had each held 20 million XRP were down to roughly 23 and 55 tokens. A third had been reduced to about 5.8 million XRP. In total, around 54 million XRP had left the original holding accounts, while about $75 million worth remained in accounts that no one can freeze under the ledger's rules.

RelatedIsraeli Ad Firm Turned Targeted Ads Into Zero-Click Spyware Delivery, Researchers Say

The picture was different for stablecoins. Circle and Tether used the blacklist controls built into their tokens to freeze about $320,000 in combined USDC and USDT tied to the theft.

Why It Matters

The contrast shows how much the choice of asset shapes recovery after a hack. The XRP Ledger lets companies freeze tokens they issue on it, but XRP itself has no issuer and no built-in way to stop a holder from spending it. CoinDesk noted that not even Ripple, the company most associated with the token, can block the attacker. Exchanges can restrict accounts that receive stolen funds on their platforms, but they cannot touch coins sitting in wallets the attacker controls.

That leaves a narrow window. Once stolen XRP moves through intermediary accounts, bridges or exchanges that do not act quickly, the chance of clawing it back shrinks. In this case, roughly 21 million XRP left the holding accounts in the eight hours after 04:32 UTC alone.

Context

Bitget disclosed Thursday that attackers had drained its internet-connected hot wallets. Chief executive Gracy Chen said the breach closely matched known patterns of North Korean hacking groups, and blockchain intelligence firm TRM Labs has attributed roughly three-quarters of 2026's crypto thefts to North Korea, TechCrunch reported. CoinDesk's Saturday report did not address attribution.

The exchange has said its user protection fund covers the losses and that customer balances are unaffected. It set out a staged restart of withdrawals: Bitcoin on Sept. 28, Ether on Sept. 29, USDT on Sept. 30 and other tokens on Oct. 2.

What to Watch

The next signals are where the moved XRP lands, whether exchanges that receive it freeze the deposits, and whether the remaining $75 million follows the same path. The staged withdrawal schedule will test whether Bitget's reserves and systems hold up once customers can move funds again. Further attribution from investigators or blockchain analytics firms would clarify whether the laundering pattern matches earlier North Korean operations.