Abstract:
After the $388 million attack on the cryptocurrency exchange Bitget, the hackers behind the scenes have transferred approximately $83 million in stolen XRP from three currency-holding wallets, and another approximately $75 million remains in accounts that cannot be frozen according to the network’s current rules.
Nearly 103 million XRP was stolen from Bitget on Thursday and dispersed to five accounts. According to a review of XRP Ledger records, as of 12:41 UTC on Saturday, two accounts that initially held 20 million XRP each had seen their balances drop to approximately 23 and 55 coins respectively. The balance of the third account has dropped to approximately 5.8 million XRP.
XRP is the currency built into the XRP Ledger, the blockchain used by payments company Ripple. The network allows businesses to freeze their tokens issued on the network, but this permission does not apply to XRP itself. Ripple has no built-in mechanism to prevent attackers from spending these XRP.
This means that efforts to recover stolen assets depend in part on where the funds go next. Exchanges that receive stolen XRP can restrict the recipient's account and prevent withdrawals. But as long as these XRP remain in attacker-controlled wallets, the exchange cannot freeze the tokens.
Circle and Tether, the companies behind U.S. dollar-pegged tokens USDC and USDT, have frozen approximately $320,000 in stablecoins related to the attack. The tokens they issue contain control mechanisms that allow companies to blacklist addresses.
Transfers of XRP accelerated overnight. As of 04:32 UTC on Saturday, approximately 70 million tokens remained in the original five accounts. About eight hours later, this balance had dropped to 49 million coins.
Some of the payments followed a path previously used by the first wallet. After a transfer of approximately 521,000 XRP failed due to insufficient balance in that account, a second account sent the exact same amount of XRP to the intended recipient about an hour later.
Currently, approximately 54 million XRP have left the original currency holding account. These transfers show that the attackers are spreading the stolen funds among more wallets, but there is no way to tell how many of them have been sold.
According to data from CoinGecko, XRP traded at about $1.54 on Saturday, down about 4% in 24 hours, but still up about 9% in a week.
At this price, the initially stolen XRP would be worth approximately $160 million, equivalent to approximately 4% of the token’s reported daily trading volume of $4.4 billion. How much the sale of these tokens will affect the price depends on the number of buy orders available in the market at the time the sale occurs.
Bitget on Friday raised its estimate of the overall amount stolen to $387.5 million, after including Zcash and TRON transfers that were omitted from the initial tally. Bitget said the revised number reflects the assets stolen during the initial attack, rather than the occurrence of another attack.
At the same time, the exchange has since confirmed that its protection fund can cover the loss and customer balances will not be affected. Bitcoin withdrawals are scheduled to resume on September 28, followed by Ethereum withdrawals on September 29, USDT withdrawals on September 30, and other token withdrawals on October 2.
Comments