Bitget's XRP withdrawal service remained disabled on September 26, with the exchange scheduling a phased reopening across multiple assets through October 2. XRP is grouped under "other tokens" in the final phase, set to begin October 2 at 08:00 UTC, following earlier reopenings of Bitcoin, Ethereum, and USDT withdrawals.
The freeze comes as blockchain analysis firm Bitquery tracked movement of stolen XRP following Bitget's September 24 security incident. Bitquery identified approximately 102.98 million XRP as taken in the breach. By 02:54 UTC on September 26, roughly 27.63 million XRP had moved from two attacker accounts, while approximately 75.35 million remained across six tracked accounts.
Token Movement and Cross-Chain Activity
Bitquery's investigation traced outgoing XRP moving through new accounts toward THORChain, a cross-chain swap network, with most of the traced XRP flow being swapped toward Bitcoin. However, the analysis tracks wallet transfers and cross-chain swaps—not spot-market sales on centralized exchanges. The transaction paths do not establish the volume or price of any XRP sold on order books or identify the ultimate owners of destination Bitcoin wallets.
Bitget updated its estimate of total value transferred to attacker-controlled addresses to approximately $387.5 million on September 25, up from $351.6 million, citing additional Zcash and TRON assets discovered in its accounting.
Exchange Operations and Next Steps
Bitget said it had identified and remedied the vulnerability and was conducting additional checks of its withdrawal infrastructure. Trading and deposits continued on the platform. The company described the withdrawal pause as a security measure and stated that user balances were unaffected.
The phased withdrawal reopening schedule begins with Bitcoin on September 28 at 08:00 UTC, followed by Ethereum on September 29 and USDT on September 30. The actual availability of each asset will be displayed on the platform as each phase begins.
