Massive $157M XRP Stash Uncovered in Bitget Hack Investigation

Recent updates from SlowMist's MistTrack platform reveal a broader and more complex asset landscape tied to the Bitget security incident. The attacker's holdings are heavily concentrated on the Ripple network but span several major blockchain ecosystems, painting a picture of sophisticated cross-chain fund dispersion.

The Primary Cache: XRP Dominates the Holdings

Seven newly flagged Ripple (XRP Ledger) addresses form the core of the exposed assets. Together, they hold approximately 102.9 million XRP. At current market rates, this stash is valued at around $157 million, representing the bulk of the identified stolen funds.

Such a large volume of XRP sitting in a cluster of addresses creates a conspicuous on-chain footprint. Analysts note that the relative transparency of the XRP Ledger could make large-scale movements difficult to fully conceal, potentially aiding future tracking efforts.

Cross-Chain Spread: Diversified Assets on EVM Chains and TRON

Beyond the XRP trove, the hacker's portfolio shows a clear multi-chain strategy:

  • EVM Chain Assets: Across 11 flagged EVM-compatible addresses (likely on Ethereum and BNB Chain among others), holdings include roughly 67,980 ETH, 5,896 BNB, and close to $500,000 in stablecoins (USDT and USDC).
  • TRON Network Assets: One identified TRON address contains about 20.59 million TRX, confirming the attacker's intent to spread assets across different blockchain environments.

This strategy of fragmenting funds across multiple chains complicates efforts by any single entity to trace or freeze the total amount, highlighting the hacker's operational knowledge.

What's Next: Monitoring Movements and Security Implications

So far, the majority of assets in these marked addresses have not been moved in large transactions. The community and regulators are closely watching for any on-chain activity that could signal the next phase of fund movement.

The scale and cross-chain nature of these holdings serve as a stark reminder for all exchanges and users. In an era of interconnected blockchains, security postures must evolve. Robust hot wallet management and private key security remain essential, but must be coupled with advanced monitoring of cross-chain flows and anomalous transaction patterns.