The hacker responsible for Bitget’s $388 million breach has transferred roughly 54 million stolen XRP from three of the five wallets that initially received the funds. The activity has renewed concerns over potential selling pressure if the stolen tokens eventually reach the open market.

Nearly 103 million XRP was taken from Bitget after its wallet infrastructure was compromised and subsequently divided among five accounts. The total amount stolen remains unchanged, but the funds have started to move after sitting largely untouched for around 24 hours.

The latest wallet activity does not establish that the attacker has sold any XRP. However, the redistribution of stolen tokens can precede liquidation attempts, making the transfers an important development for XRP traders.

By 12:41 UTC on Saturday, two wallets that had each started with 20 million XRP were almost entirely emptied. One contained roughly 23 XRP, while the other held about 55 XRP. A third wallet, which had received a larger share of the stolen funds, had been reduced to approximately 5.8 million XRP.

About 49 million XRP, valued at roughly $75 million, remained spread across the five original wallets at that time.

XRP was trading around $1.47, down approximately 3% over the past 24 hours but still up around 3% for the week. The limited reaction suggests the market has so far viewed the wallet movements as a potential source of risk rather than confirmation that a major XRP sell-off is underway.

The stolen XRP was worth approximately $160 million when the breach occurred, representing around 4% of XRP’s reported $4.4 billion in daily trading volume. However, daily volume does not equal readily available order-book liquidity, so a large sale could still have a noticeable impact on price.

Native XRP Cannot Be Frozen

Centralized exchanges can take action when flagged XRP reaches their platforms. They may restrict the receiving account and block withdrawals after identifying the stolen funds.

That control does not extend to XRP held in a private wallet controlled by the attacker. XRP is the native asset of the XRP Ledger, while the network’s freeze mechanism applies to issued tokens rather than native XRP.

As a result, Ripple has no built-in way to freeze XRP while it remains under the attacker’s control. Transfers between private wallets therefore confirm movement but do not confirm liquidation.

The situation would become more significant if the stolen XRP were deposited into a recognizable exchange address or converted into another asset on-chain. Such activity would provide stronger evidence of potential selling. The eventual price impact would still depend on the amount of buy-side liquidity available at that time.

Bitget Resumes Withdrawals in Stages

Bitget is also progressing with its post-breach recovery schedule. Bitcoin withdrawals are set to resume on September 28, followed by Ethereum on September 29, USDT on September 30 and other tokens on October 2.

The exchange has said its protection fund will cover the losses and that customer balances have not been affected.

The key question for XRP markets is now what happens to the roughly $75 million worth of stolen XRP still sitting across the original wallets. Whether those tokens remain inactive, move to fresh addresses or reach an exchange could determine whether the current risk remains limited or develops into additional market pressure.