Bitget hack, part 3: the stolen XRP is flowing into a laundering pipeline that deposits to Binance and MEXC

In part 2 we showed that 102.9 million XRP from the Bitget hack sits in five parking wallets on the XRP Ledger, and that one of them had started peeling off small amounts through fresh hop accounts. We said the thing to watch was destination tags, because an exchange deposit is the first point where anyone can intervene. This morning the tags appeared. They point at Binance and MEXC, and they belong to a laundering pipeline that was built the week before Bitget was hacked. All times UTC; XRP at $1.55.

Update, September 29. The pipeline described here went on to process the entire XRP haul: between September 25 and 28 the four exit accounts deposited 59.9 million XRP into the four Binance customer tags listed below. Figures and what Bitget has since confirmed are in part 5: four days later.

Update, September 25, 12:45 UTC. The drain has changed gear: 789,000 XRP left the parking wallet in eight minutes and went straight into the pipeline’s feeder accounts, and exchange deposits have passed 488,000 XRP. Continued in part 4.

Update, September 25, 12:20 UTC. A second channel: FixedFloat. The hop account rhdAf…2w3p has opened a route into a no-KYC instant-swap service. At 11:56 it created rhFTj1a11XxKBJDS7yUqFRvdQJuR4q3Fw4, which at 12:00 sent 100 XRP to rffGCKC7Mk4cQ5aUGg8pfRe3MPC7Cy8gfe, the account XRPScan labels as FixedFloat, with destination tag 271367. It then passed 4,899 XRP to a further new account, rLyk3ZpCo5ta4W3MsYsLdrvswCGBKAfXcS, which sent 500 XRP (tag 491592) and 1,000 XRP (tag 345292) to the same FixedFloat account at 12:12 and 12:14. Three different tags means three separate swap orders: this is someone testing order sizes before sending more. FixedFloat converts XRP into other assets without identity checks, so anything that goes through it leaves the XRP Ledger and our ability to follow it here.

Meanwhile the exchange route keeps accelerating. Since 10:30 UTC the four exits have made 74 deposits totalling 299,029 XRP (about $463,000): 130,266 XRP to Binance tag 470475839, 82,149 to tag 469304937, 41,999 to tag 472578608, 29,180 to tag 465674229, and 15,435 to MEXC tag 646914. Bitget-derived XRP is also now entering the pipeline through its feeder layer: at 12:15 a new account funded by rhdAf…2w3p sent 50,095 XRP to rU7dx6W…UnDF, one of the six accounts that supply the hub.

Update, September 25, 12:00 UTC. The pipeline is now running at full speed. The second tranche did not queue: rH5w29…xMHW sent the 145,430 XRP straight to the hub r4du…T5ig at 11:39:20, and the hub began paying the exits 52 seconds later. Between 11:40 and 11:57 the hub and the collector made 16 payments to the exits, and the exits made 20 deposits into Binance. Running tally since the first Bitget-derived XRP reached the hub at 10:30 UTC:

Exit	Deposits	XRP	Destination
rfF1rd…BYaL	7	41,999	Binance 11, tag 472578608
rhbgGt…mBLa	12	79,289	Binance 11, tag 469304937
rNnMCi…RzfS	18	73,805	Binance 11, tag 470475839
rs6Sp4…Q1gr	5	18,395	MEXC 1 tag 646914 (15,435) and Binance 11 tag 465674229 (2,960)
Total	42	213,489 XRP (about $331,000)

That is roughly 100,000 XRP per 20 minutes at the current pace. A separate 30,000 XRP left hop account rhdAf…2w3p at 11:38 for a new account, rKcDFVGCxqexNaZVF84k2AF2iRtHZs9FFB, where it still sits. Neither Binance nor MEXC has announced a freeze; the four Binance deposit accounts were still accepting funds at 11:57.

Update, September 25, 11:40 UTC. A second tranche has left the parking wallet on what looks like a timer. At 11:27:22 rDRV9…95hs sent 146,283.8 XRP to the same hop account as before, rFPGG…mgrV; at 11:30:31 that account forwarded 145,430 XRP to rH5w29…xMHW and at 11:34 swept the 853.8 XRP remainder to the same leftover account used last time. Amounts, hop accounts and three-minute spacing match the 09:32 tranche almost exactly, one hour and 55 minutes apart. Reusing hop accounts is sloppy for a laundering operation and suggests a script rather than an operator. Total peeled from this parking wallet: about 693,000 XRP ($1.07M). If the cadence holds, the next tranche is due around 13:25 UTC.

Update, September 25, 11:20 UTC. The queued tranche has started to exit. At 11:06:01 the collector r3n8sb…HpN1, which had received 145,513 XRP from the Bitget parking wallet 44 minutes earlier, sent 11,732 XRP to exit rNnMCi…RzfS. Thirty seconds later that exit deposited 11,544 XRP into Binance hot wallet rNxp4h8…N7AV with destination tag 470475839 (transaction at 11:06:31). This is the first exchange deposit that can be tied to a specific Bitget tranche rather than inferred from commingling. In the same minutes the other three exits deposited 6,818 XRP (tag 472578608), 4,806 XRP (tag 469304937) and 2,960 XRP into Binance under a fourth tag, 465674229, which the fourth exit uses alongside its MEXC account. The collector still holds about 224,000 XRP.

From the parking wallet to the hub

Two tranches have now left the Bitget cluster and entered a network that has nothing to do with the hack’s original addresses.

Tranche 1, 3,610 XRP. At 01:37 on September 25 the parking wallet rDRV9…95hs sent 3,615 XRP to a new account, rnt3Kxjf…aLbB. At 02:13 that account forwarded 3,610 XRP to r4duMqEXMMmWpaN8LC2URmmVE2JkqTT5ig. Small, but it is the first Bitget-derived XRP to touch an account that existed before the hack.

Tranche 2, 145,513 XRP. At 09:32 the same parking wallet sent 146,369 XRP to a new account, rFPGG…mgrV, which at 09:42 sent 145,515 XRP to rH5w29…xMHW. That account split it at 10:19 and 10:22: 50,000 XRP to rsRyTs…Wd9p and 95,514 XRP to r3n8sbJGiJe1jG1CT9V1m7Ptu4a3AiHpN1. Three minutes later rsRyTs…Wd9p also forwarded its 49,999 XRP to r3n8sb…HpN1. As of 10:40 the 145,513 XRP is sitting there, in an account that holds 236,000 XRP in total.

r4du…T5ig and r3n8sb…HpN1 were both created on September 20, 2026 at 17:26 UTC, within the same minute, four days before the hack.

What the hub does

r4du…T5ig is a distribution hub. Since September 20 it has received roughly 800,000 XRP from a handful of feeder accounts and has paid it out in 2,000 to 11,000 XRP chunks to four fixed exit accounts. The pattern is mechanical: a batch of six to ten payments within a few minutes, several times a day.

Exit account	Created	Originally funded by	Deposits to	Destination tag
rfF1rdR3gpZ6z6Me9HUWTaSj4EdQudBYaL	Jul 2025	Binance 6	Binance 11	472578608
rhbgGt9jVGvVnuDPmXEXxeqhuPwBGHmBLa	Jul 2025	Binance 10	Binance 11	469304937
rNnMCi68fuqVCk9nFPjat8mnzCzQGLRzfS	Jul 2025	Binance 18	Binance 11	470475839
rs6Sp4vUwKPrPz6th9CYwp74yqqdYjQ1gr	Oct 2025	Binance 15	Binance 11 and, since Sept 25, MEXC 1	465674229 (Binance), 646914 (MEXC)

“Binance 11” is rNxp4h8apvRis6mJf9Sh8C6iRxfrDWN7AV and “MEXC 1” is rs2dgzYeqYqsk8bvkQR5YPyqsXYcA24MP2, both labeled exchange hot wallets on XRPScan. On the XRP Ledger a deposit to an exchange is a payment to the exchange’s shared hot wallet plus a destination tag that identifies the customer account. Each exit account uses one tag, always the same one, so each exit feeds exactly one customer account. The exit accounts were themselves created by withdrawals from Binance in 2025, which means the operator has held Binance accounts for over a year.

Volume through the exits since September 20, counting only tagged exchange deposits: at least 789,000 XRP from rfF1rd…BYaL, 369,000 from rhbgGt…mBLa, 405,000 from rNnMCi…RzfS and 219,000 from rs6Sp4…Q1gr, about 1.78 million XRP or $2.8 million. Since the Bitget hack began at 18:31 on September 24: 10,236, 66,232 and 65,146 XRP into the three Binance accounts and 24,744 XRP into the MEXC account, about 166,000 XRP. The most recent deposits we saw landed at 10:31, 10:33, 10:35, 10:36 and 10:37 today.

Who feeds the hub

The hub’s money comes from six accounts created between September 17 and September 20: raG99zq…GVYn (554,000 XRP into the hub), rLXoBjy…xEK8 (88,500), rGP5LBf…6Esp, rEweM9k…RGVs, rU7dx6W…UnDF and rpnu6dE…anqi. Several of them pay with a memo of the form OUT: followed by a 64-character hex string, which is the style of payout wallets run by instant-swap services, where the memo carries the order or transaction id. rGP5LBf…6Esp alone has cycled through 2.4 million XRP. None of these accounts is labeled on XRPScan, and we are not naming a service without confirmation.

This matters for the attribution question. On-chain analyst Specter reported that ETH paid out by the Bridgers swap service for stolen XRP connects to wallets tagged as the TraderTraitor cluster, which Blockaid links to the Lazarus Group and to the July AFX Trade theft of about $24 million. Specter’s graph runs through a single wallet holding a few thousand dollars and is, by their own description, thin. What we can show independently is narrower and firmer: the Bitget XRP is being processed by a hub-and-exit network that was assembled the week before the hack and was already converting XRP into Binance and MEXC deposits before Bitget lost a single coin. Whether that network is the attacker’s own or a laundering service the attacker rents, the ledger does not say.

Timing of the first Bitget-derived deposits

The hub received Bitget-derived XRP at 02:13. Its next outgoing batch was at 10:24 to 10:30: eleven payments totalling 51,444 XRP to rhbgGt…mBLa, rs6Sp4…Q1gr and rNnMCi…RzfS. Those three exits forwarded to Binance and MEXC between 10:31 and 10:37. The hub does not segregate funds, so the 3,610 XRP from Bitget was almost certainly part of those deposits. The 145,513 XRP now in r3n8sb…HpN1 will follow the same route; that account has historically paid out to the same four exits and nowhere else of consequence.

What this means

• There is now a named counterparty. Four customer accounts, three at Binance and one at MEXC, have been receiving this pipeline’s output for five days. Both exchanges can see who holds them, freeze the balances, and tell Bitget’s investigators what has already been withdrawn.
• The scale is small so far. About 550,000 XRP has left the Bitget parking wallets, half a percent of the XRP haul. The 20-million-XRP wallets have not moved. This is a rehearsal at production scale, not the main event.
• The main event will look different. A pipeline that moves 10,000 XRP at a time cannot absorb 100 million XRP. Expect either many more exits and exchanges, or a shift to bridges and cross-chain swap services, or both.

Addresses to flag

For exchanges, analysts and anyone running compliance screening, the accounts that have handled Bitget-derived XRP outside the original attacker cluster:

Hub and collector (created 2026-09-20 17:26 UTC):
  r4duMqEXMMmWpaN8LC2URmmVE2JkqTT5ig
  r3n8sbJGiJe1jG1CT9V1m7Ptu4a3AiHpN1
Exits (deposit to exchanges):
  rfF1rdR3gpZ6z6Me9HUWTaSj4EdQudBYaL   -> Binance 11, tag 472578608
  rhbgGt9jVGvVnuDPmXEXxeqhuPwBGHmBLa   -> Binance 11, tag 469304937
  rNnMCi68fuqVCk9nFPjat8mnzCzQGLRzfS   -> Binance 11, tag 470475839
  rs6Sp4vUwKPrPz6th9CYwp74yqqdYjQ1gr   -> Binance 11, tag 465674229; MEXC 1, tag 646914
Hops from the Bitget parking wallet (all created 2026-09-25):
  rnt3Kxjfb2TnvuBY5ZkakuuSyhgAoqaLbB, rFPGGZNwcpD2ZJLdwtKh6DBMmHJkPmgrV,
  rH5w29GnVgiM9HHjRrzuhjEERQSTNSxMHW, rsRyTsYNg1xSXmqFsjegaFX6gZFRmpWd9p

We are checking these accounts every 20 minutes and will publish again when the large parking wallets move or when an exchange confirms a freeze.