Bitget confirmed that, as of 12:11 UTC on 26 September, the platform still accepts XRP deposits but blocks any outbound transfers to external wallets. The exchange has outlined a phased restoration of withdrawal services: Bitcoin withdrawals are slated to resume on 28 September at 08:00 UTC, followed by Ethereum on 29 September and USDT on 30 September. All remaining assets, grouped under “other tokens,” together with fiat and peer-to-peer services, are scheduled for 02 October. XRP is not listed separately, placing it in that final batch.
Scale of the breach
The incident, traced to a vulnerability exploited on 24 September, has been linked to a North-Korean actor and resulted in an estimated $387.5 million loss across multiple cryptocurrencies. For XRP alone, analytics firm Bitquery identified roughly 102.98 million tokens transferred to attacker-controlled accounts. By 02:54 UTC on 26 September, two of the six monitored addresses had moved 27.63 million XRP onward, while the remaining 75.35 million stayed in the original wallets. These figures represent token balances, not the volume sold on exchanges.
Tracing the stolen XRP
Bitquery’s investigation followed the outbound flow of the compromised XRP through newly created wallets and into THORChain, a protocol that enables cross-chain swaps. The majority of the traceable movement appeared to be directed toward Bitcoin, indicating that the attackers are converting the stolen ledger asset into a more liquid form. The analysis does not reveal the ultimate owners of the Bitcoin addresses receiving the swaps.
Exchange response and user impact
Bitget says it has patched the vulnerability that enabled the breach and is conducting additional checks on its withdrawal infrastructure. While trading and deposit functions continue to operate, the split between a functional trading venue and a disabled withdrawal path means users can still adjust their XRP positions on-platform but cannot transfer the asset off-chain. The platform’s public status page reflects this dichotomy, and the actual reopening of XRP withdrawals will be confirmed when the system shows an active withdrawal option.
Why it matters
The continued blockage of XRP withdrawals limits users’ ability to move their holdings to external wallets, potentially affecting liquidity for the token on a major exchange. Moreover, the observed migration of stolen XRP into a cross-chain swap network and its conversion to Bitcoin highlight a tactic that could obscure the trail of illicit funds, complicating forensic and regulatory efforts. Monitoring the upcoming Oct. 2 deadline will be crucial for assessing both user protection and the broader market impact of the breach.
