The attacker behind the Bitget breach has transferred roughly $83 million in stolen XRP from three of the five wallets that initially received the funds. About $75 million worth of XRP remains across those original addresses.

Nearly 103 million XRP was taken from Bitget on Thursday and distributed among five wallets. By 12:41 UTC Saturday, two addresses that each initially held around 20 million XRP had been almost completely emptied, with only about 23 and 55 tokens left. A third wallet had fallen to roughly 5.8 million XRP, according to CoinDesk’s analysis of XRP Ledger data.

XRP is the native token of the XRP Ledger, the blockchain associated with payments company Ripple. While tokens issued on the network can include freezing controls, XRP itself does not have that functionality. Ripple therefore cannot directly freeze the stolen coins or stop the attacker from transferring them.

Instead, recovery may depend on whether the XRP eventually reaches a centralized exchange. Exchanges can restrict accounts that receive stolen funds and block withdrawals, but they cannot freeze XRP while it remains in an attacker-controlled wallet.

Stablecoin issuers Circle and Tether have already frozen around $320,000 in USDC and USDT connected to the breach. Their tokens include controls that allow the issuers to blacklist specific wallet addresses.

The stolen XRP began moving more rapidly overnight. At 04:32 UTC Saturday, approximately 70 million XRP remained in the five original wallets. Around eight hours later, the combined balance had declined to roughly 49 million XRP.

Some of the transactions have followed patterns seen earlier in the attack. In one case, a transfer of about 521,000 XRP failed because the sending wallet did not have enough funds. Approximately an hour later, another wallet sent the same amount to the originally intended recipient.

Around 54 million XRP has now left the five initial addresses. The transactions suggest the attacker is distributing the stolen assets among more wallets, although the ledger activity does not reveal whether any of the tokens have been sold.

XRP was trading near $1.54 on Saturday, according to CoinGecko. The token had fallen roughly 4% over the previous 24 hours but remained about 9% higher over the week.

At that price, the original XRP haul was valued at approximately $160 million. That represents around 4% of XRP’s reported $4.4 billion in daily trading volume. The potential price impact of a sale would depend on the available buy-side liquidity when the transaction takes place.

Bitget revised its total-loss estimate to $387.5 million on Friday after identifying additional Zcash and TRON transfers that had been left out of its initial calculation. The exchange said those assets were part of the original breach and did not result from a separate attack.

Bitget has said its protection fund can cover the stolen assets and that customer balances have not been affected. The exchange plans to resume Bitcoin withdrawals on Sept. 28, followed by Ether on Sept. 29, USDT on Sept. 30 and other tokens on Oct. 2.