Bitget’s XRP withdrawal route was still disabled on Sept. 26, even as the exchange set Oct. 2 at 08:00 UTC for the last phase of its post-breach withdrawal reopening. Its published timetable names BTC, ETH and USDT for earlier phases, then “other tokens,” fiat and peer-to-peer services for Oct. 2. XRP is not listed separately, so the schedule places it in that final group by exclusion. Bitget’s public XRP coin status showed external XRP withdrawals disabled and deposits enabled at 12:11 UTC on Sept. 26.
The timing matters to XRP holders because the stolen tokens are also moving. Bitquery measured 27.63 million XRP moving onward from two tracked attacker accounts by 02:54 UTC on Sept. 26, while 75.35 million remained in six tracked accounts. That is a dated account-balance snapshot, not a measure of XRP sold into the market. It leaves two different developments to watch: when customers can withdraw their XRP, and where the stolen XRP goes next.
Bitget’s first scheduled withdrawal phase starts with BTC on the Bitcoin network on Sept. 28 at 08:00 UTC. ETH follows on Sept. 29 across the networks named in its notice, and USDT follows on Sept. 30. The Oct. 2 phase covers everything grouped under other tokens, along with fiat and peer-to-peer services. Each date is a planned start; Bitget says actual withdrawal availability will appear on its platform.
The exchange said it had identified and remedied the vulnerability involved in the Sept. 24 incident and was carrying out further checks of its withdrawal infrastructure. It described the pause as a security measure and said user balances were unaffected. Trading and deposits continue, according to Bitget. Its public XRP status reflected that split on Sept. 26: the XRP network was open for deposits while external withdrawals were off.
For a customer, the open trading venue and the closed XRP withdrawal route serve different purposes. A holder could change an XRP position on Bitget under the trading service the company says remains available. The API status showed that the same holder could not withdraw XRP to an outside XRP Ledger address at the time of the check. The Oct. 2 entry offers a timetable for that route; an enabled platform status and a functioning withdrawal will show whether it has opened.
Where the stolen XRP has gone
Bitquery’s transaction-backed investigation put the XRP taken from Bitget at about 102.98 million tokens. In its Sept. 26 snapshot, 27.63 million XRP had moved onward from two of the six attacker accounts it tracked. The other 75.35 million XRP remained across those six accounts at 02:54 UTC. The figures can change as funds move, and transfers out of an initial account do not identify who ultimately controls the destination.
The analytics firm followed outgoing XRP through new accounts toward THORChain, a cross-chain swap network. It said most of the XRP flow it could follow was being swapped toward Bitcoin. That description applies to the route Bitquery traced, not necessarily to the full 27.63 million XRP that moved onward. The investigation also cannot identify the owners of the final Bitcoin wallets.
Those transactions show a path from stolen XRP toward another asset. They do not establish the net XRP sold in a centralized exchange order book or the price of any such sale. The distinction matters when weighing potential market pressure: movement among wallets, a cross-chain swap and an executed spot trade are separate observations. Bitquery’s figures establish the first two for the routes it followed; its trace does not measure a breach-linked spot sale.
Bitget’s Sept. 25 incident update revised its estimate of the total value transferred to attacker-controlled addresses to about $387.5 million, up from $351.6 million. The company said the higher figure reflected additional Zcash and TRON assets in its accounting rather than further unauthorized transfers. This is the platform-wide, multi-asset loss. Bitquery’s roughly 102.98 million XRP is a separate token count for one affected asset.
CryptoSlate’s XRP market data displayed XRP near $1.55 when checked on Sept. 26 and listed a Bitget XRP/USDT market. That snapshot supplies a dated price reference. It contains no bid-ask spread and cannot attribute an XRP price change to the breach. The next observable tests are Bitget’s XRP withdrawal status as Oct. 2 approaches and timestamped updates to the attacker-account balances and conversion routes.
