Bitget Hacker Moves $83 Million in XRP That Ripple Cannot Freeze

A hacker behind the breach of crypto exchange Bitget has moved roughly $83 million worth of stolen XRP out of three holding wallets into new addresses, exposing a structural weakness that stablecoin issuers do not share: nobody can freeze it. Unlike Circle’s USDC or Tether’s USDT, native XRP on the XRP Ledger cannot be locked by Ripple, leaving investigators and the exchange with far fewer options to claw back funds once they start moving.

The breach was first detected Thursday, September 24, 2026, and by Friday the total estimated theft had been revised to $387.5 million, making it one of the costliest exchange hacks of the year. Bitget has said its protection fund covers the loss in full and that customer balances remain unaffected, a claim the exchange has paired with a phased schedule for resuming withdrawals: bitcoin from Monday, September 28, ether the following day, USDT on September 30, and other tokens by October 2. Earlier reporting detailed how the losses climbed to $387.5 million as investigators reconstructed the scope of the intrusion, and separate coverage explained how the attackers relied on spoofed transfers rather than stolen private keys to siphon funds out of exchange wallets.

How the XRP Trail Diverges From Stablecoins

Of the roughly 103 million XRP stolen, split across five accounts, two were drained from 20 million tokens each down to negligible balances — around 23 and 55 tokens respectively — while a third fell to about 5.8 million XRP. Blockchain trackers recorded 70 million XRP still sitting in the original holding accounts at 04:32 UTC on Saturday; eight hours later that figure had dropped to 49 million, and by the time monitoring stood at 12:41 UTC roughly 54 million XRP had been moved out of the original wallets altogether. One transfer of about 521,000 XRP initially failed, then succeeded an hour later through a second wallet, suggesting the attacker is actively probing the network rather than executing a single scripted sweep.

That stands in sharp contrast to how stablecoin issuers responded to the same breach. Circle and Tether froze roughly $320,000 in USDC and USDT tied to the hack within a day, using the blacklist controls built into their token contracts — the same mechanism examined in earlier coverage of how Circle and Tether froze a Bitget hacker wallet but captured comparatively little of the total haul. XRP offers no equivalent lever. Ripple, the company most closely associated with the token, has no built-in mechanism to halt transfers or blacklist addresses on the ledger, meaning roughly $75 million in XRP still sitting in the hacker’s accounts remains just as movable as the $83 million already relocated.

What the Freeze Gap Means for Exchanges and Investors

The episode illustrates a real divergence in how different blockchain architectures handle bad actors. Issuer-backed stablecoins are, by design, centralized instruments: Circle and Tether can and do intervene when law enforcement or exchanges flag stolen funds, a capability that has drawn its own scrutiny — including questions raised in a separate case over Tether and Bitfinex’s banking ties under a DOJ forfeiture complaint. Native assets like XRP, bitcoin, or ether operate under a different philosophy, prioritizing censorship resistance over recoverability. That tradeoff is usually framed as a feature. After a hack of this scale, it looks more like a liability for victims trying to trace and recover assets.

For Bitget’s users, the immediate financial exposure appears limited: the exchange has stated its protection fund absorbs the loss, and the staggered reopening of withdrawals suggests operational confidence that the situation is contained. But the broader market implications are harder to dismiss. XRP was trading around $1.54 at last check, down about 4% over 24 hours even as it remained up roughly 9% for the week, according to CoinGecko — a reminder that a $160 million initial haul, equivalent to about 4% of XRP’s $4.4 billion daily trading volume, is large enough to register in price action without derailing the broader trend.

What to Watch Next

Several threads remain open. Investigators and exchanges will be watching whether the hacker attempts to convert the remaining $75 million in XRP into other assets, potentially routing through decentralized exchanges or bridges where freezing is equally impossible. Bitget’s phased withdrawal resumption — bitcoin, then ether, then USDT, then other tokens through early October — will serve as an informal gauge of how confident the exchange is in its own security posture. And the debate over asset freezability is likely to resurface in policy circles already examining how centralized control over dollar-pegged tokens might be used more deliberately, a question raised in recent discussion of Washington’s interest in turning dollar stablecoins into a foreign policy tool. Whether that same logic ever extends to non-issuer-controlled networks like the XRP Ledger remains an open and, for now, unanswered question.

Source: CoinDesk

This content is for informational purposes only and does not constitute financial or investment advice.