Bitget hack, part 3: the stolen XRP is flowing into a laundering pipeline that deposits to Binance and MEXC

In part 2 we showed that 102.9 million XRP from the Bitget hack sits in five parking wallets on the XRP Ledger, and that one of them had started peeling off small amounts through fresh hop accounts. We said the thing to watch was destination tags, because an exchange deposit is the first point where anyone can intervene. This morning the tags appeared. They point at Binance and MEXC, and they belong to a laundering pipeline that was built the week before Bitget was hacked. All times UTC; XRP at $1.55.

Update, September 25, 11:20 UTC. The queued tranche has started to exit. At 11:06:01 the collector r3n8sb…HpN1, which had received 145,513 XRP from the Bitget parking wallet 44 minutes earlier, sent 11,732 XRP to exit rNnMCi…RzfS. Thirty seconds later that exit deposited 11,544 XRP into Binance hot wallet rNxp4h8…N7AV with destination tag 470475839 (transaction at 11:06:31). This is the first exchange deposit that can be tied to a specific Bitget tranche rather than inferred from commingling. In the same minutes the other three exits deposited 6,818 XRP (tag 472578608), 4,806 XRP (tag 469304937) and 2,960 XRP into Binance under a fourth tag, 465674229, which the fourth exit uses alongside its MEXC account. The collector still holds about 224,000 XRP.

From the parking wallet to the hub

Two tranches have now left the Bitget cluster and entered a network that has nothing to do with the hack’s original addresses.

Tranche 1, 3,610 XRP. At 01:37 on September 25 the parking wallet rDRV9…95hs sent 3,615 XRP to a new account, rnt3Kxjf…aLbB. At 02:13 that account forwarded 3,610 XRP to r4duMqEXMMmWpaN8LC2URmmVE2JkqTT5ig. Small, but it is the first Bitget-derived XRP to touch an account that existed before the hack.

Tranche 2, 145,513 XRP. At 09:32 the same parking wallet sent 146,369 XRP to a new account, rFPGG…mgrV, which at 09:42 sent 145,515 XRP to rH5w29…xMHW. That account split it at 10:19 and 10:22: 50,000 XRP to rsRyTs…Wd9p and 95,514 XRP to r3n8sbJGiJe1jG1CT9V1m7Ptu4a3AiHpN1. Three minutes later rsRyTs…Wd9p also forwarded its 49,999 XRP to r3n8sb…HpN1. As of 10:40 the 145,513 XRP is sitting there, in an account that holds 236,000 XRP in total.

r4du…T5ig and r3n8sb…HpN1 were both created on September 20, 2026 at 17:26 UTC, within the same minute, four days before the hack.

What the hub does

r4du…T5ig is a distribution hub. Since September 20 it has received roughly 800,000 XRP from a handful of feeder accounts and has paid it out in 2,000 to 11,000 XRP chunks to four fixed exit accounts. The pattern is mechanical: a batch of six to ten payments within a few minutes, several times a day.

Exit account	Created	Originally funded by	Deposits to	Destination tag
rfF1rdR3gpZ6z6Me9HUWTaSj4EdQudBYaL	Jul 2025	Binance 6	Binance 11	472578608
rhbgGt9jVGvVnuDPmXEXxeqhuPwBGHmBLa	Jul 2025	Binance 10	Binance 11	469304937
rNnMCi68fuqVCk9nFPjat8mnzCzQGLRzfS	Jul 2025	Binance 18	Binance 11	470475839
rs6Sp4vUwKPrPz6th9CYwp74yqqdYjQ1gr	Oct 2025	Binance 15	Binance 11 and, since Sept 25, MEXC 1	465674229 (Binance), 646914 (MEXC)

“Binance 11” is rNxp4h8apvRis6mJf9Sh8C6iRxfrDWN7AV and “MEXC 1” is rs2dgzYeqYqsk8bvkQR5YPyqsXYcA24MP2, both labeled exchange hot wallets on XRPScan. On the XRP Ledger a deposit to an exchange is a payment to the exchange’s shared hot wallet plus a destination tag that identifies the customer account. Each exit account uses one tag, always the same one, so each exit feeds exactly one customer account. The exit accounts were themselves created by withdrawals from Binance in 2025, which means the operator has held Binance accounts for over a year.

Volume through the exits since September 20, counting only tagged exchange deposits: at least 789,000 XRP from rfF1rd…BYaL, 369,000 from rhbgGt…mBLa, 405,000 from rNnMCi…RzfS and 219,000 from rs6Sp4…Q1gr, about 1.78 million XRP or $2.8 million. Since the Bitget hack began at 18:31 on September 24: 10,236, 66,232 and 65,146 XRP into the three Binance accounts and 24,744 XRP into the MEXC account, about 166,000 XRP. The most recent deposits we saw landed at 10:31, 10:33, 10:35, 10:36 and 10:37 today.

Who feeds the hub

The hub’s money comes from six accounts created between September 17 and September 20: raG99zq…GVYn (554,000 XRP into the hub), rLXoBjy…xEK8 (88,500), rGP5LBf…6Esp, rEweM9k…RGVs, rU7dx6W…UnDF and rpnu6dE…anqi. Several of them pay with a memo of the form OUT: followed by a 64-character hex string, which is the style of payout wallets run by instant-swap services, where the memo carries the order or transaction id. rGP5LBf…6Esp alone has cycled through 2.4 million XRP. None of these accounts is labeled on XRPScan, and we are not naming a service without confirmation.

This matters for the attribution question. On-chain analyst Specter reported that ETH paid out by the Bridgers swap service for stolen XRP connects to wallets tagged as the TraderTraitor cluster, which Blockaid links to the Lazarus Group and to the July AFX Trade theft of about $24 million. Specter’s graph runs through a single wallet holding a few thousand dollars and is, by their own description, thin. What we can show independently is narrower and firmer: the Bitget XRP is being processed by a hub-and-exit network that was assembled the week before the hack and was already converting XRP into Binance and MEXC deposits before Bitget lost a single coin. Whether that network is the attacker’s own or a laundering service the attacker rents, the ledger does not say.

Timing of the first Bitget-derived deposits

The hub received Bitget-derived XRP at 02:13. Its next outgoing batch was at 10:24 to 10:30: eleven payments totalling 51,444 XRP to rhbgGt…mBLa, rs6Sp4…Q1gr and rNnMCi…RzfS. Those three exits forwarded to Binance and MEXC between 10:31 and 10:37. The hub does not segregate funds, so the 3,610 XRP from Bitget was almost certainly part of those deposits. The 145,513 XRP now in r3n8sb…HpN1 will follow the same route; that account has historically paid out to the same four exits and nowhere else of consequence.

What this means

• There is now a named counterparty. Four customer accounts, three at Binance and one at MEXC, have been receiving this pipeline’s output for five days. Both exchanges can see who holds them, freeze the balances, and tell Bitget’s investigators what has already been withdrawn.
• The scale is small so far. About 550,000 XRP has left the Bitget parking wallets, half a percent of the XRP haul. The 20-million-XRP wallets have not moved. This is a rehearsal at production scale, not the main event.
• The main event will look different. A pipeline that moves 10,000 XRP at a time cannot absorb 100 million XRP. Expect either many more exits and exchanges, or a shift to bridges and cross-chain swap services, or both.

Addresses to flag

For exchanges, analysts and anyone running compliance screening, the accounts that have handled Bitget-derived XRP outside the original attacker cluster:

Hub and collector (created 2026-09-20 17:26 UTC):
  r4duMqEXMMmWpaN8LC2URmmVE2JkqTT5ig
  r3n8sbJGiJe1jG1CT9V1m7Ptu4a3AiHpN1
Exits (deposit to exchanges):
  rfF1rdR3gpZ6z6Me9HUWTaSj4EdQudBYaL   -> Binance 11, tag 472578608
  rhbgGt9jVGvVnuDPmXEXxeqhuPwBGHmBLa   -> Binance 11, tag 469304937
  rNnMCi68fuqVCk9nFPjat8mnzCzQGLRzfS   -> Binance 11, tag 470475839
  rs6Sp4vUwKPrPz6th9CYwp74yqqdYjQ1gr   -> Binance 11, tag 465674229; MEXC 1, tag 646914
Hops from the Bitget parking wallet (all created 2026-09-25):
  rnt3Kxjfb2TnvuBY5ZkakuuSyhgAoqaLbB, rFPGGZNwcpD2ZJLdwtKh6DBMmHJkPmgrV,
  rH5w29GnVgiM9HHjRrzuhjEERQSTNSxMHW, rsRyTsYNg1xSXmqFsjegaFX6gZFRmpWd9p

We are checking these accounts every 20 minutes and will publish again when the large parking wallets move or when an exchange confirms a freeze.