Bitget hack, part 4: the XRP drain is accelerating, with 1.5M XRP out of the parking wallet and half a million already inside Binance
Between 12:17 and 12:25 UTC the Bitget attacker released 789,000 XRP from one parking wallet, five times the earlier tranches, and pushed it straight into the feeder accounts of the laundering pipeline. Exchange deposits since 10:30 have reached 120 transactions and 488,000 XRP. Neither Binance nor MEXC has acted.
Key facts
- Parking wallet rDRV9nLg8xbLsafKZnhNgWuE1TiSLE95hs has released 1,482,121 XRP (about $2.3M) since 23:03 UTC on September 24; 789,363 XRP of that left in four payments between 12:17 and 12:25 UTC on September 25.
- The large tranches no longer go through hop accounts one at a time: 300,000 XRP went directly into feeder account rU7dx6W4YUaKMk5exCgEC8e9j7gY39UnDF and 100,000 XRP into rGP5LBfA7aBB6Pfh8CsVVCfiMffTdT6Esp, the accounts that supply the hub.
- Since 10:30 UTC the pipeline's four exit accounts have made 120 deposits totalling 488,139 XRP (about $757,000) into four Binance customer accounts and one MEXC account, with 189,000 XRP of that in the last 20 minutes.
- About 1.34 million XRP of Bitget-derived funds is currently staged inside the pipeline's collector, hub and feeder accounts, waiting to be deposited.
- The other four XRP parking wallets (82.98 million XRP) and the eight Ethereum parking wallets (68,295 ETH) have not moved. No exchange has announced a freeze.
Three hours ago the Bitget attacker was peeling 146,000 XRP off a parking wallet every two hours and pushing it through a chain of throwaway accounts. That phase is over. Between 12:17 and 12:25 UTC the same wallet released 789,363 XRP in four payments and sent most of it straight into the feeder accounts of the laundering network described in part 3. The network’s exits have since been depositing into Binance at close to 10,000 XRP a minute. All times UTC; XRP at $1.55.
What left the parking wallet
| Time | XRP | To | What happened next |
|---|---|---|---|
| 12:17:21 | 134,248 | rFPGG…mgrV (hop) | to rH5w29…xMHW at 12:18, to rsRyTs…Wd9p at 12:20, to collector r3n8sb…HpN1 at 12:22 |
| 12:18:52 | 32,003 | rE6C7vZDywhQrpt356eXZ66jVSKA8nWT4y (new) | still there |
| 12:24:32 | 265,412 | rPfox…xwMR (hop) | 300,000 to feeder rU7dx6…UnDF at 12:26 |
| 12:25:41 | 357,701 | rPfox…xwMR (hop) | 100,000 to feeder rGP5LB…6Esp at 12:31; 223,222 still in the hop |
At the same time the older hop rhdAf…2w3p emptied itself: 90,000 XRP to the collector via a new account at 12:30, and 97,478 XRP to feeder rpnu6d…anqi via another new account at 12:32.
The parking wallet started the day at 20,000,000 XRP. It now holds 18,517,879. The 1,482,121 XRP that has left is worth about $2.3 million.
Where it is now
The Bitget-derived XRP is spread across the network’s staging accounts rather than sitting in fresh hops:
| Account | Role | Balance at 12:37 |
|---|---|---|
r3n8sb…HpN1 | collector | 376,238 |
r4du…T5ig | hub | 305,297 |
rU7dx6…UnDF | feeder | 232,990 |
rPfox…xwMR | hop | 223,222 |
rGP5LB…6Esp | feeder | 103,249 |
rpnu6d…anqi | feeder | 70,420 |
rE6C7…WT4y | new | 32,003 |
| Total staged | about 1.34 million XRP ($2.1M) |
The feeders, hub and collector all drain into the same four exit accounts, and the exits deposit into the same five exchange accounts. So this 1.34 million XRP is in the queue for Binance and MEXC unless something interrupts it.
What has reached the exchanges
Tagged deposits by the four exits since 10:30 UTC, when Bitget-derived XRP first reached the hub:
| Exchange account | Deposits | XRP |
|---|---|---|
| Binance 11, tag 470475839 | 61 | 219,848 |
| Binance 11, tag 469304937 | 19 | 106,798 |
| Binance 11, tag 465674229 | 32 | 98,060 |
| Binance 11, tag 472578608 | 8 | 47,998 |
| MEXC 1, tag 646914 | 15,435 | |
| Total | 120 | 488,139 XRP (about $757,000) |
The last 20 minutes alone added about 189,000 XRP. A separate probe of the no-KYC swap service FixedFloat, described in part 3, has so far taken only 1,600 XRP.
What has not happened
- The other four XRP parking wallets, holding 82,976,677 XRP between them, have not sent a single payment.
- The eight Ethereum parking wallets, holding 68,295 ETH, have not moved.
- Binance and MEXC have not announced any freeze, and the four Binance deposit accounts were still accepting funds at 12:37.
- Bitget has not published its incident report, which it promised for 21:30 UTC today.
Why the change in pace matters
A peel chain that moves 146,000 XRP every two hours is cautious. Releasing 790,000 XRP in eight minutes and feeding it directly into the supply side of the network is not. Either the operator has decided that speed matters more than concealment, perhaps expecting the deposit accounts to be closed soon, or the pipeline has proved that its Binance accounts absorb whatever is sent. The next hour will tell which: if deposits continue at the current rate the staged 1.34 million XRP will be inside exchanges by roughly 15:00 UTC, and the parking wallet’s remaining 18.5 million will be the next question.
We are checking every 20 minutes and will publish when a second parking wallet moves, when an exchange acts, or when Bitget names the compromised component.