Bitget hacker moves $157M in XRP and Ripple cannot freeze it
An attacker linked to Bitget’s approximately $387.5 million breach has moved about 102–103 million stolen XRP, worth roughly $157 million, from three of the five original wallets that held the funds. Around $75 million in XRP remains in the initial addresses. XRP cannot be frozen at the ledger level because it is a native asset without an issuer. Transparency on the XRP Ledger enables tracing but not recovery once an attacker controls the private keys.
Assets Hacked Lookonchain
Key movements and ledger constraints:
- Theft and distribution: Nearly 103 million XRP was taken on Thursday, September 24, and split across five accounts. By 12:41 UTC on Saturday, September 26, two wallets that began with 20 million XRP each fell to about 23 XRP and 55 XRP. A third wallet remained with roughly 5.8 million XRP. About 54 million XRP has exited the original holding accounts, indicating redistribution rather than confirmed selling.
- Flow cadence: Around 70 million XRP remained across the original accounts at 04:32 UTC Saturday. Eight hours later the balance fell to roughly 49 million. One attempted transfer of about 521,000 XRP failed for insufficient funds, then the same amount was sent from another attacker wallet, showing direct native transfers between attacker-controlled addresses.
- Freeze mechanics: The XRP Ledger supports freezing only for issued tokens via trust lines. Stablecoin issuers used blacklist controls to freeze about $320,000 in USDC and USDT related to the breach. XRP has no issuer and cannot be frozen while held in an attacker’s self-custodied account. Exchanges can only restrict recipient accounts if the XRP arrives on their platforms.
Incident scope and Bitget response:
- Updated loss: Bitget raised the theft estimate to $387.5 million on Friday, September 25, after including Zcash and TRON outflows identified through further tracing. The exchange stated this is a refinement of the initial count, not a separate breach.
- Coverage and operations: Bitget says its protection fund covers the entire loss and customer balances remain unaffected. Withdrawals resume in phases:
- Bitcoin: from September 28
- Ether: from September 29
- USDT: from September 30
- Remaining tokens: from October 2
Market context:
- XRP price: Approximately $1.54 at reporting time, down about 4% over 24 hours, up roughly 9% on the week.
Structural takeaway:
- XRP’s design prioritizes permissionless control of native assets. Ledger-level transparency facilitates monitoring of stolen funds but does not provide a recovery mechanism for XRP. Recovery depends on interception at compliant exchanges if the attacker attempts to deposit.
