Where Bitget's Stolen 103 Million XRP Went

Bitget is a crypto exchange. Two of its XRP wallets, both named “Bitget Global” in XRPScan’s public address list (rwTTsH…XLEf, rGDreB…GzFn), sent 102,976,680 XRP in three payments to one brand-new wallet between 19:01 and 21:19 UTC on 24 Sep. Bitget confirmed the theft that evening (notice) and named that wallet as the attacker’s (addresses).

The new wallet split the XRP between five more wallets the same evening. From there it was spread over 185 further wallets, all created after the theft, and sent on.

The first swap left at 25 Sep 02:13 UTC. Half the XRP was gone by 26 Sep 13:00, and 99% by 27 Sep 08:00. Most payments went out in many small pieces from many wallets, not in one transfer.

THORChain is a network that swaps coins between blockchains. You send XRP to its address on the XRP Ledger with a short note saying which coin you want and where to send it, and it pays you on the other blockchain. The note is public: =:b: followed by an address means “swap to Bitcoin and pay this address” (THORChain memos, short codes).

76 of the thief’s wallets sent 5,282 such swaps. Smaller amounts went to two other swap services, NEAR Intents and Bridgers. 15,493 XRP is still in the thief’s wallets.

Bitget says its customers do not lose: account balances were never reduced, and its User Protection Fund, over $464 million, covers the loss. In its CEO’s words, “User funds are covered on a 1:1 basis” (Bitget, 24 Sep, Gracy Chen, 25 Sep).

• The theft hit several blockchains, about $387.5 million in all; XRP was the largest single loss (25 Sep).
• Withdrawals reopened in steps from 28 September, XRP with the other tokens on 2 October (26 Sep).
• The attacker got in through third-party security devices and moved on to Bitget’s warm and hot wallets, according to Mandiant (30 Sep, report).

Swapping through THORChain, NEAR Intents or Bridgers in those days does not connect you to the theft. Their vaults and deposit addresses belong to the services and are not on our scam list; only the thief’s own wallets are.

To check an address before you send to it, open its page on xrpl.to or ask the scam check, which needs no key: https://api.xrpl.to/v1/scams/check/<address> (docs). The whole list is at /v1/scams/addresses.

XRP itself cannot be frozen, so once it left Bitget nobody could stop it on the ledger (Coinspeaker).

Every payment out of the wallet that received the stolen XRP, followed through the wallets it went to, created after the theft, until the money reached THORChain, another swap service or an exchange. THORChain refunds that were sent again are counted once. Ledger data to 2 Oct 2026.