Bitget keeps XRP withdrawals frozen as 27M stolen tokens flow onward

By Khal · · 1 min read

Editorial illustration: Silver XRP coins sit behind a frosted blue gate on the left, while other XRP coins travel along a curved conveyor emerging from a cracked metal enclosure.
AI-generated editorial illustration · AI-generated editorial illustration · Published Sep 27, 2026, 5:33 p.m. (52 minutes ago)

In brief

  • Bitget's XRP withdrawals stayed disabled Sept. 26 following the Sept. 24 security breach
  • Bitquery traced 27.63 million XRP moving from attacker accounts; 75.35 million remained
  • Exchange plans phased reopening: BTC Sept. 28, ETH Sept. 29, USDT Sept. 30
  • Bitget revised total breach loss estimate to $387.5 million from $351.6 million

Stolen XRP on the move

Bitquery traced 27.63 million XRP moving from two attacker accounts by 02:54 UTC on September 26. The analytics firm's broader investigation estimated the total XRP taken at approximately 102.98 million tokens. As of the same timestamp, 75.35 million XRP remained in six tracked attacker accounts.

The flow patterns matter for what they reveal about attacker behavior. Bitquery followed outgoing XRP through new accounts toward THORChain, a cross-chain swap network. Most of the XRP flow it could track was being swapped toward Bitcoin. Yet blockchain movement doesn't confirm spot-market sales or establish realized prices.

Phased withdrawal restart

Bitget scheduled October 2 at 08:00 UTC for the final phase of its post-breach withdrawal reopening. The exchange began rolling out access in stages. BTC withdrawals on the Bitcoin network started September 28 at 08:00 UTC. ETH followed on September 29 across specified networks, and USDT was scheduled for September 30.

XRP holders faced a different timeline. The XRP network remained open for deposits while external withdrawals stayed disabled on September 26. Bitget described the pause as a security measure and said user balances were unaffected.

Revised damage assessment

Bitget revised its estimate of total value transferred to attacker-controlled addresses to approximately $387.5 million on September 25, up from the initial $351.6 million figure. The company attributed the higher estimate to additional Zcash and TRON assets in its accounting. Bitget said it had identified and remedied the vulnerability involved in the September 24 incident. Trading and deposits continued on Bitget following the breach.

Related stories