The incident of Bitget suffering a $387.5 million hacker attack has entered a new phase, as the attackers have begun to transfer the largest portion of the stolen assets out of the exchange.
Approximately $83 million of the stolen XRP has been transferred out of the initial three wallet holders, while there is still about $75 million in assets remaining in accounts that cannot be frozen using the native control mechanism of XRP Ledger.
Meanwhile, blockchain investigators traced approximately 68,465 ETH tokens, valued at around $184 million, which have entered the attacker-controlled Ethereum wallet, constituting another large batch of encrypted assets that are being closely monitored by the recovery team.
Bitget confirmed in the latest official security update that the total affected amount is approximately $387.5 million, which is higher than the initial estimate of $351.6 million. This is due to the identification of additional Zcash and Tron transfers later on.
XRP Revealing the Limitations of "Freezing Cryptocurrencies"
The transfer of XRP exposes an important difference between native blockchain assets and tokens controlled by the issuer.
The issuers on XRP Ledger can freeze the tokens they create, but the native XRP itself cannot be frozen by Ripple. Exchanges that receive stolen XRP can freeze accounts under their control, but Ripple cannot remotely prevent attackers from continuing to transfer XRP out of wallets controlled by them.
This is very different from stablecoins.
Due to the blocklist feature controlled by the issuer, which is enabled for USDC and USDT, Circle and Tether have frozen approximately $320,000 in USDC and USDT related to this security incident.
The attacker initially received approximately 103 million XRP, valued at around 160 million US dollars at the time of the theft. According to post-event chain tracing data, about 54 million of these XRP have since left the initial holding account.
Ethereum asset stacks may become the next major trend in development
The situation with Ethereum is different in this regard.
According to the on-chain investigation firm Bitquery, after the attackers exchanged stablecoins and transferred other network assets across chains, approximately 68,465 units of ETH were traced to 9 Ethereum wallets.
According to their latest detailed snapshot, 8 of these wallet holders have not made any transactions yet.
This means that the market is currently focusing on two distinctly different types of recovery challenges: XRP has begun to disperse to new addresses, while the larger ETH concentrated holdings are still visible but could be transferred at any time.
Bitget indicates that the relevant vulnerabilities have been fixed, and their protection fund will cover the financial impacts of this incident. The exchange plans to resume withdrawals in stages: Bitcoin withdrawals will be restored on September 28th, Ethereum withdrawals on September 29th, USDT withdrawals on September 30th, and withdrawals for the remaining assets on October 2nd.
Coinpaper indicates that an earlier report discussed unconfirmed clues that may be related to North Korea.
