Bitget says crypto theft reached $387.5M as stolen XRP moves through wallets

Bitget said about $387.5 million in cryptocurrency was transferred to attacker-controlled addresses during a security breach, raising its estimate of the theft as the exchange works to trace and recover the assets.The crypto exchange initially estimated that $351.6 million was affected by the Sept. 24 attack. Bitget said the higher figure reflects a more complete accounting that includes assets on the Zcash and TRON networks that were omitted from the original estimate. It does not represent additional unauthorized transfers.Bitget, whose trading platform isn't available to U.S. residents, said it has identified and fixed the vulnerability exploited in the attack. The company said the breach is contained and no further unauthorized transfers are possible.The affected assets include XRP, Ether, Tether, Zcash, USDC, USDT0, Tether Gold, BNB, Avalanche and TRX. The transfers occurred across Ethereum and other EVM-compatible networks as well as the XRP Ledger, Zcash and TRON.Nearly 103 million XRP stolenXRP accounted for one of the largest portions of the theft, with public blockchain records showing nearly 103 million XRP transferred from Bitget-linked wallets.Bitget has identified the XRP address that initially received the funds as controlled by the attacker. XRP Ledger data shows that address received about 103 million XRP before distributing most of the tokens among five wallets.Independent blockchain analysis by BitOK calculated about 102.98 million XRP flowing into the address during three large transfers on Sept. 24.The stolen XRP has since begun moving again.A review of XRP Ledger records by CoinDesk found that about 54 million XRP had left the five original holding wallets by 12:41 UTC Saturday. Two wallets that initially contained about 20 million XRP each had been almost emptied, while another had fallen to about 5.8 million XRP.About 49 million XRP remained across the five original accounts at that point, down from roughly 70 million about eight hours earlier.Those transactions show that the stolen XRP is being redistributed among additional blockchain addresses. They don't establish that the tokens have been sold.That distinction is important for XRP investors. Transfers between wallets do not necessarily create selling pressure. The market effect would depend on whether the cryptocurrency is ultimately sold and how much liquidity is available to absorb those sales.XRP cannot simply be frozenRecovering the XRP also presents a technical problem.Unlike stablecoins such as USDC and USDT, XRP is the native asset of the XRP Ledger rather than a token issued by a company. That means Ripple cannot blacklist an address and freeze its XRP.Centralized exchanges can still intervene if stolen XRP reaches their platforms. An exchange can identify a deposit linked to the theft, restrict the associated customer account and prevent further withdrawals.Circle and Tether have already frozen about $320,000 in USDC and USDT connected to the breach, according to CoinDesk.Bitget suspects North Korean involvementBitget CEO Gracy Chen said in an X post and live Q&A that preliminary IP and blockchain analysis pointed to possible involvement by North Korean hackers. She said investigators identified IP addresses linked to VPN services used by a North Korean hacking group and on-chain patterns resembling previous attacks attributed to North Korean actors.The attribution hasn’t been independently confirmed. Mandiant and blockchain security firm SlowMist are assisting Bitget with the investigation.Chen said the attackers did not obtain Bitget's private keys. Instead, according to the company's investigation, they compromised a backend system within its wallet infrastructure, spoofed transaction information and caused Bitget's authorization system to approve transfers.The precise method used to gain access to the backend system remains under investigation.Bitget offers recovery bountyBitget has launched a bounty program as it seeks help recovering the stolen assets.The exchange said eligible participants can receive 5% of affected funds they directly help freeze and 5% of funds they help recover.Bitget said some assets have already been frozen through cooperation with exchanges, blockchain projects, security companies and other industry participants. The company has also published a live tracing system that allows outside researchers and crypto companies to monitor addresses linked to the attack.Bitget said its User Protection Fund will cover the financial impact of the breach and that customer account balances remain unaffected.Why it matters for crypto investorsThe $387.5 million theft underscores the security risks facing centralized cryptocurrency exchanges even when attackers do not obtain the private keys controlling their wallets.It also highlights an important difference among digital assets. Stablecoin issuers can sometimes freeze stolen tokens, while native cryptocurrencies such as XRP can continue moving unless they reach an exchange or other intermediary willing and able to intervene.For XRP investors, the movement of more than half of the roughly 103 million stolen tokens from their initial holding wallets bears watching. Those transfers do not prove the XRP has reached the market, but attempts to liquidate a large amount could create additional supply.Bitget plans to restore withdrawals in stages. Bitcoin withdrawals are scheduled to resume Sept. 28, followed by Ether on Sept. 29, USDT on Sept. 30 and other tokens, fiat withdrawals and peer-to-peer services on Oct. 2.Content provided by Seeking Alpha is intended for information purposes only, and that Seeking Alpha does not offer any personalist investment advice and is not a licensed securities dealer, broker, US investment adviser or investment bank.