On-chain analysis shows that the attacker has already drained two of the five original holding accounts almost entirely and is actively moving money from a third. Approximately $75 million worth of XRP remains across the five wallets, leaving a significant sum still exposed.
The movement of funds highlights a key technical limitation: unlike some cryptocurrencies—such as those with built-in freeze or blacklist functions—XRP's native blockchain does not give Ripple the ability to halt transfers once tokens leave an exchange's control. This has complicated recovery efforts, as the stolen assets can be freely shifted across wallets.
The Bitget hack, which occurred earlier this year, has drawn continued scrutiny as the perpetrator systematically liquidates the haul. Security teams and blockchain forensic firms are monitoring the wallets, but the attacker's ability to move funds without interference has so far prevented recovery.