Bitget hack, part 2: the $160M in XRP that nobody can freeze is already starting to move

In part 1 we followed the Bitget exploiter across Ethereum and Avalanche and ended with about 68,000 ETH parked in eight addresses. That accounted for roughly $183 million of a $351.6 million loss. The rest, it turns out, is mostly XRP, and the XRP Ledger tells a story the EVM chains could not: a failed theft, a refill by Bitget itself, and the first signs of the stolen funds being prepared for cash-out. Prices at the time of writing: XRP $1.55, ETH $2,690, TRX $0.338, BNB $776. All times UTC.

Update, September 25, 10:45 UTC. The peeled-off XRP has reached exchange deposit accounts. It is flowing through a hub-and-exit network built on September 17 to 20 that deposits into Binance and MEXC with fixed destination tags. Read part 3. Parking wallet rDRV9…95hs has now sent out about 546,000 XRP in total; the other four parking wallets are untouched.

The breakdown

Bitget still has not published a per-asset inventory. The most complete list comes from Lookonchain, and it reconciles well with what we can see on-chain:

Asset	Amount	Value (Lookonchain)
XRP	102,926,478	$157.5M
ETH	31,890	$85.8M
USDT	34,751,168	$34.8M
USDC	21,056,725	$21.1M
USDT0	19,668,852	$19.7M
XAUT	3,000	$12.8M
BNB	12,719	$9.9M
AVAX	821,012	$8.4M
TRX	20,593,377	$7.1M
Total		about $357M

The ETH, USDT, USDC, XAUT and AVAX lines match the transfers we documented in part 1 to the unit. USDC is higher than the 12.85M we saw arrive at the primary Ethereum address because a further 8.2M left on Avalanche. USDT0 is the Arbitrum leg we could not verify. BNB and TRX are the BNB Chain and TRON legs we could not query.

SlowMist’s MistTrack, which tracks 11 EVM addresses, seven XRP Ledger addresses and one TRON address, reported at 01:17 UTC on September 25 that they held about 67,980 ETH, 5,897 BNB, 218,023 USDT, 99,990 USDC, 102.9 million XRP and 20.59 million TRX. Our own EVM count is 68,295 ETH after a late consolidation. At current prices that cluster is worth about $355 million, so the money has not gone anywhere yet. It has only changed shape.

What the XRP Ledger shows

Bitget’s XRP hot wallets are publicly labeled “Bitget Global” on XRPScan: rwTTsHVUDF8Ub2nzV2oAeWxfJzUvobXLEf and rGDreBvnHrX1get7na3J4oowN19ny4GzFn. We pulled their transaction history from a public XRPL node.

Time (UTC, Sept 24)	Event
19:01:32	rGDre…GzFn sends 2,248,871.5 XRP to a brand-new account, rwNhefsz1UQEusxhCvHip3RANinWi4CTck
19:16:20	rwTT…XLEf sends 91,420,942.8 XRP to the same account
20:28:20	rwTT…XLEf attempts to send 9,142,093.8 XRP; the payment fails with tecUNFUNDED_PAYMENT because the wallet no longer holds enough
20:40:02	Bitget’s rGDre…GzFn sends 2,183,079.5 XRP into rwTT…XLEf, an internal top-up
21:19:21	rwTT…XLEf sends 9,306,865.8 XRP to the attacker; this time it succeeds

Total taken on the XRP Ledger: 102,976,680 XRP, about $159.6 million at today’s price. The timing matches Ethereum exactly: the first XRP left one minute after the first large ETH transfer, and the last XRP left four minutes before the last ETH transfer at 21:23.

The refill is the detail worth sitting with. At 20:28, two hours after Bitget says it detected the attack, the compromised signing pipeline tried to drain the hot wallet again and failed only because the wallet was nearly empty. Twelve minutes later Bitget’s own aggregation wallet moved 2.18 million XRP into that hot wallet, and 39 minutes after that the pipeline drained it again, successfully. Whether the top-up was an automated rebalancing job or a manual action, it shows that the process feeding the hot wallet was still running while the process draining it had not been stopped.

Where the XRP is now

Between 21:42 and 23:43 the attacker split the haul into five parking accounts:

Account	XRP
rDRV9nLg8xbLsafKZnhNgWuE1TiSLE95hs	19,453,526 as of 10:40 UTC Sept 25 (20,000,000 minus outflows; see update above)
r3UGfDM4ZyFSCzKH7TQEjgago9QoUJagtJ	20,000,000
rH7oMFKBgdK99TPQctFVzddD7srRzyCqZn	20,000,000
rwSjBrtxBC75TqZ5YvJ1TGfaRpQvVNsAKw	20,000,000
r6NcwN3dR5ciyBv9XsLyMNc9Kg2FBCs7Y	22,976,677

The original receiving account holds 3 XRP. Four of the five parking wallets have not moved. The first one has.

The first outflows

Starting at 23:03 UTC on September 24, and continuing through 04:01 UTC on September 25, rDRV9…95hs has been sending small amounts to freshly created accounts:

Time (UTC)	Amount	To
Sept 24 23:03	19,206 XRP	rhdAf73TPX45LmHeZqxzLMdtd44jrY2w3p
Sept 24 23:04	308,580 XRP	same
Sept 25 01:37	3,615 XRP	rnt3Kxjf…aLbB
Sept 25 02:01	56,586 XRP	rHCPH9VC…a3ET
Sept 25 02:47	3,674 XRP	rnSzWAeW…thoT
Sept 25 03:00	8,443 XRP	rwRnFu7Q…Ef2C

About 400,000 XRP so far, roughly $620,000. Each hop account then forwards most of its balance to another new account, sometimes in round trips: rhdAf…2w3p sent 163,892 XRP to rJudF…tUtj at 23:11 and received 163,891 back three minutes later, then sent 200,000 and got 199,998 back. Several hops carry test-sized amounts of 4, 10, 100 or 200 XRP.

None of these payments carries a destination tag, and none of the receiving accounts is labeled as an exchange on XRPScan. That matters: deposits to a centralized exchange almost always require a destination tag, so what we are seeing is not yet a cash-out. It looks like a rehearsal of a peel chain, the technique of shaving small amounts off a large balance through a sequence of throwaway accounts so that any one transfer looks unremarkable. One destination stands out: r4duMqEXMMmWpaN8LC2URmmVE2JkqTT5ig was created on September 20, four days before the hack, and already held about 225,000 XRP before receiving 3,610 XRP from this chain. Infrastructure prepared in advance, or a coincidence; we cannot tell from the ledger alone.

Why this half of the haul is different

Tether, Circle and Tether Gold can blacklist addresses, which is exactly why the attacker converted their stablecoins and gold into ETH within 23 minutes on Ethereum. On the XRP Ledger there was no need to hurry. The ledger’s freeze feature applies only to issued tokens held through trust lines; native XRP has no freeze, no blacklist and no issuer. Ripple, the XRP Ledger Foundation and the validators cannot lock these balances. The only points of intervention are the exchanges and OTC desks the attacker will eventually need in order to sell, which is why the appearance of destination tags in this chain is the signal to watch.

The whole picture

Chain	Held by attacker	Approx. value
Ethereum	68,295 ETH	$183.7M
XRP Ledger	102.9M XRP	$159.5M
TRON	20.59M TRX (per SlowMist)	$7.0M
BNB Chain	5,897 BNB (per SlowMist; 12,719 taken)	$4.6M
Stablecoin residue on EVM	218,023 USDT + 99,990 USDC	$0.3M
Total		about $355M

Bitget’s estimate was $351.6 million. The two numbers differ only by price movement since the attack.

What to watch

1. Destination tags on any payment leaving the XRP hop accounts. That will be the first exchange deposit.
2. The four untouched XRP parking wallets and the eight ETH parking wallets. Nothing has left them.
3. Bitget’s incident report, which has been promised for 21:30 UTC on September 25. It should explain which backend component forged the instructions and why the pipeline that refilled the XRP hot wallet at 20:40 was still running two hours after detection.

We are checking all of these addresses every 20 minutes and will publish a follow-up when the funds start to leave the cluster or when Bitget names the compromised component.