Cryptocurrency exchange Bitget kept external XRP withdrawals disabled on Sept. 26, even as blockchain intelligence firm Bitquery tracked 27.63 million XRP moving out of attacker-controlled accounts following a major security breach.
Bitget Withdrawal Timetable and Security Status
Following the Sept. 24 exploit, Bitget released a phased timetable to restore external withdrawal services across its platform. According to the official schedule, BTC withdrawals on the Bitcoin network are set to reopen first on Sept. 28 at 08:00 UTC, followed by ETH on Sept. 29 and USDT on Sept. 30. All remaining digital assets, including XRP, alongside fiat and peer-to-peer services, are grouped into the final reopening phase scheduled for Oct. 2 at 08:00 UTC.
While external withdrawals remained offline, Bitget reported that trading and deposit functionalities remained fully active. Public API status checks confirmed that XRP network deposits were enabled at 12:11 UTC on Sept. 26, allowing users to trade or deposit assets internally. Bitget stated it has identified and patched the vulnerability behind the breach, maintaining that customer account balances remain unaffected while infrastructure checks continue. On Sept. 25, Bitget adjusted its total platform-wide loss estimate to $387.5 million—up from an initial $351.6 million—explaining that the revision resulted from updated accounting of Zcash and TRON assets rather than additional unauthorized transfers.
Tracing the Stolen XRP Funds
Analytics provider Bitquery identified roughly 102.98 million XRP as having been stolen from Bitget during the incident. As of 02:54 UTC on Sept. 26, Bitquery reported that 27.63 million XRP had moved out of two primary attacker accounts into secondary addresses. The remaining 75.35 million XRP remained static across six tracked attacker wallets.
Tracing the outbound transactions, Bitquery observed funds moving toward THORChain, which recently rejected Bitget's request to freeze stolen assets. The firm reported that most of the traced XRP was being swapped into Bitcoin. Bitquery noted that moving tokens across cross-chain bridges does not directly indicate an executed spot market sell-off on centralized exchanges, meaning wallet transfers and swaps should not be confused with immediate order book sell pressure. During these transfers, market data placed XRP trading near $1.55, as technical structures continued to test key price points like XRP support levels.
Key Takeaways
- Withdrawal Schedule: Bitget set Oct. 2 at 08:00 UTC for the final phase of withdrawal reopenings, covering XRP, fiat, and P2P services.
- Loss Revision: Total platform loss estimates were updated to $387.5 million due to added Zcash and TRON accounting.
- On-Chain Movement: 27.63 million XRP out of 102.98 million XRP stolen moved onward, with primary routes targeting THORChain cross-chain swaps to Bitcoin.
- Wallet Balance: 75.35 million XRP remained stationary across six tracked attacker wallets as of Sept. 26 at 02:54 UTC.
Why It Matters
The delay in restoring XRP withdrawals highlights the operational friction centralized exchanges face when containing severe security breaches. By routing stolen tokens through cross-chain protocols like THORChain to convert into Bitcoin, attackers are increasingly relying on decentralized bridges to obfuscate asset trails and bypass centralized freeze requests. Market participants will be watching Oct. 2 closely to verify whether Bitget successfully restores full withdrawal functionality and if the remaining 75.35 million XRP begins moving into secondary markets.
