Bitget Hacker Moves $83 Million in Stolen XRP Beyond Reach of Freeze Controls
Key Takeaways
- •The Bitget hacker has moved about $83 million in stolen XRP out of three wallets that had initially received the funds.
- •Roughly 54 million of the nearly 103 million stolen XRP has left the original five holding wallets, while about $75 million worth remains there.
- •Bitget previously estimated total losses from the breach at close to $400 million, with the stolen XRP making up a significant share of that amount.
- •XRP cannot be frozen by Ripple or any issuer because the XRP Ledger's freeze controls apply only to tokens issued on the network, not to XRP itself.
- •Circle and Tether froze approximately $320,000 in USDC and USDT tied to the attack blacklisting addresses, while the stolen XRP continued to move.
The hacker behind the Bitget exchange breach has moved approximately $83 million worth of stolen XRP out of three holding wallets, a development that highlights a key structural difference between the XRP Ledger's native asset and issuer-controlled stablecoins such asDC and USDT.
According to XRP Ledger data reviewed by BitcoinKE, the nearly 103 million XRP stolen from Bitget was initially distributed across five receiving wallets. About 54 million XRP — equivalent to just over half of the stolen amount — has since left those holdings, while roughly $75 million worth of XRP remained across the original accounts as of this writing.
The movement comes as Bitget continues to respond to the fallout from the security breach, in which the exchange has previously said stolen funds were nearing $400 million. The stolen XRP makes up a significant share of that overall figure, and its path since the breach shows how differently the incident's assets behave once they leave the exchange's hands.
Unlike USDC and USDT, which are issuer-controlled tokens, XRP cannot be frozen by its issuer or by Ripple. XRP is the native asset of the XRP Ledger, and the network's freeze controls apply to tokens issued on the ledger rather than to XRP itself. Ripple therefore has no built-in mechanism to block the attacker from transferring or spending the stolen XRP.
The contrast was evident within the same breach. Circle and Tether, the issuers of USDC and USDT, have frozen about $320,000 in stablecoins linked to the attack, using controls that allow them to blacklist addresses. A freeze on the ledger prevents the transfer of affected token balances, which is how the two issuers were able to immobilize the linked funds. The split outcome — stablecoins immobilized at the issuer level while XRP kept moving — shows how each asset's underlying design set the boundaries of containment within a single incident.
Exchanges and other platforms receiving the stolen XRP can also restrict the accounts involved and prevent withdrawals, but they cannot freeze the XRP itself while it remains in an attacker-controlled wallet.
The distinction leaves recovery of the stolen XRP largely dependent on where the funds move next. Whether the remaining holdings reach centralized exchanges or other platforms capable of restricting the accounts that receive them is the development to watch as the funds continue to move.
Source: BitcoinKE
