Bitget Keeps XRP Withdrawals Locked as 27.6 Million Stolen Tokens Move
•
September 27, 2026 3:12 pm
•
Comments
Bitget customers could trade and deposit XRP over the weekend, but they still could not move it off the exchange. That split matters more now because millions of XRP tied to the platform’s September 24 breach have begun moving through new wallets.
CryptoSlate reported that Bitget’s public XRP status showed deposits enabled and external withdrawals disabled on September 26. The exchange’s reopening timetable puts XRP in the final group scheduled for October 2 at 08:00 UTC, after separate phases for Bitcoin, Ethereum and USDT.
That is a timetable, not a guarantee that every withdrawal route will switch on at the same moment. Bitget has said the actual status shown on its platform will determine availability.
The exchange said it had identified and fixed the vulnerability involved in the September 24 incident and was continuing to check its withdrawal infrastructure. It described the pause as a security measure while trading and deposits remained available.
Bitget also said user balances were unaffected, although its revised estimate put the platform-wide value transferred to attacker-controlled addresses at about $387.5 million. That larger figure covered multiple assets and is separate from the XRP token count traced onchain.
The stolen XRP is already moving.
Bitquery’s onchain investigation gives the other half of the story. The analytics firm traced about 102.98 million XRP taken in the breach.
By 02:54 UTC on September 26, it said 27.63 million XRP had moved onward from two tracked attacker accounts. Another 75.35 million XRP remained across six accounts in its snapshot.
Bitget hack: how $352M left, and where it is nowhttps://t.co/vkXKfNqQsC
— Bitquery.io ( Bloxy ) (@Bitquery_io) September 25, 2026
Bitquery followed some of the outgoing XRP through fresh accounts toward THORChain, where the flow could be swapped across chains. It said much of the route it could follow was moving toward Bitcoin.
There is an important limit on what those transactions prove. A transfer out of an attacker wallet is not automatically a sale.
A cross-chain swap is not the same thing as an XRP order hitting a centralized exchange book. The trace shows movement and conversion routes, but it does not establish how much breach-linked XRP was sold into the spot market.
Bitget lost about $352M on Sep 24.
We traced all 21 transfers out of its wallets, across 8 blockchains.
Here's how the money left, and where it sits now. pic.twitter.com/2TFzynhuDA
— Bitquery.io ( Bloxy ) (@Bitquery_io) September 25, 2026
Trading access is not withdrawal access.
Bitget has said trading and deposits remained available and that user balances were unaffected. For an XRP holder, however, those services are not interchangeable with a working withdrawal route.
A customer can change a position inside the venue while still being unable to send XRP to a self-custody address on the XRP Ledger.
The exchange said it identified and fixed the vulnerability behind the incident and was carrying out additional checks on its withdrawal infrastructure. Its first scheduled reopening phase begins with Bitcoin on September 28.
Ethereum follows on September 29 and USDT on September 30. Other tokens, fiat and peer-to-peer services are grouped into the October 2 phase.
The most useful signals now are concrete ones: Bitget’s live XRP status changing from disabled to enabled, a successful external withdrawal, and updated onchain balances for the tracked attacker accounts. Until then, customers have a reopening date to watch, but not yet a restored XRP exit.
XRP was near $1.55 in the source’s September 26 market snapshot. That price alone does not tell investors how much of the stolen supply reached a market or whether the breach caused any particular move.
The cleaner story is operational: Bitget’s XRP door remained shut while a measurable portion of the stolen tokens was already traveling elsewhere.
Join the conversation!
We have no tolerance for comments containing violence, racism, profanity, vulgarity, doxing, or discourteous behavior. If a comment is spam, instead of replying to it please click the icon below and to the right of that comment. Thank you for partnering with us to maintain fruitful conversation.