The $387.5 million Bitget hack has entered a new phase as attackers begin moving the largest stolen assets beyond the exchange itself.
Roughly $83 million in stolen XRP has now moved out of three original holding wallets, while about $75 million worth remains in accounts that cannot be frozen through the XRP Ledgers native controls.
At the same time, blockchain investigators have tracked roughly 68,465 ETH worth about $184 million into attacker-controlled Ethereum wallets, creating a second large pool of crypto that recovery teams are watching closely.
Bitget confirmed in its latest official security update that the final affected amount is approximately $387.5 million, up from the original $351.6 million estimate after additional Zcash and Tron transfers were identified.
Discover more
Crypto wallet review
Blockchain consulting services
Enterprise blockchain solutions
XRP Shows Why “Freezing Crypto” Has Limits
The XRP movement exposes an important distinction between native blockchain assets and issuer-controlled tokens.
XRP Ledger issuers can freeze tokens they create, but native XRP itself cannot be frozen by Ripple. An exchange receiving stolen XRP can block an account under its own control, but Ripple cannot remotely prevent an attacker-controlled XRPL wallet from sending XRP elsewhere.
That is very different from stablecoins.
Circle and Tether have already frozen roughly $320,000 in USDC and USDT linked to the breach because those assets include issuer-controlled blacklist functions.
The attacker initially received roughly 103 million XRP, worth about $160 million around the time of the theft. Around 54 million XRP has since left the original holding accounts, according to onchain tracking reviewed after the breach.
The Ethereum Pile Could Be the Next Major Movement
The Ethereum side is different.
Onchain investigation firm Bitquery traced roughly 68,465 ETH into nine Ethereum wallets after the attackers swapped stablecoins and bridged assets from other networks.
As of its latest detailed snapshot, eight of those holding wallets had not sent a transaction.
That means the market is now watching two very different recovery problems: XRP is already dispersing across new addresses, while a much larger ETH concentration remains visible but movable at any moment.
Discover more
investments
Financial technology news
Ethereum staking service
Bitget says its vulnerability has been fixed and its Protection Fund covers the financial impact. The exchange plans to restart Bitcoin withdrawals on Sept. 28, Ethereum on Sept. 29, USDT on Sept. 30 and remaining assets on Oct. 2 through a phased restoration process.
Our first coverage also examined the still-unconfirmed possible North Korea connection.