The XRP in the Bitget breach is no longer sitting where it first landed. A CoinDesk review of XRP Ledger records found that roughly 54 million XRP had left the five original accounts used to hold the Bitget haul by 12:41 UTC on September 26. Two accounts that began with 20 million XRP each had been reduced to about 23 and 55 XRP, while a third still held roughly 5.8 million XRP.

About 49 million XRP, valued near $75 million at the time, remained in those first five accounts. That figure counts only the original holding accounts: funds that leave them can still sit under the attacker's control in newly created wallets, and the ledger alone cannot show how much of the moved supply remains within the attacker's reach. The central on-chain question is whether the XRP ultimately reaches a service that can identify and stop whoever controls it.

The Five Original Wallets Show Only the First Stage

To understand what the $83 million figure actually measures, it helps to separate the original theft from the later redistribution. Public blockchain records show that roughly 103 million XRP left two Bitget-linked XRPL accounts on September 24 and arrived at the address rwNhefsz1UQEusxhCvHip3RANinWi4CTck. Arkham has placed that address in its Bitget Hacker entity. The funds were then split among five holding accounts.

That two-stage pattern — consolidation first, redistribution later — is a common shape for laundering after exchange breaches, and it marks the line between what public ledger data can establish and what it cannot. The split confirms where the XRP first went. It cannot, by itself, show whether each later address belongs to the same operator, a laundering intermediary or an exchange customer. Calling every transfer a “cash-out” would overstate the evidence. A movement between attacker-controlled wallets does not create new selling pressure on its own; selling becomes a concrete risk only when the route reaches a centralized exchange, OTC desk, instant-swap service or another gateway that can convert XRP into a different asset or fiat money.

Ripple Cannot Freeze a Native XRP Balance

The limitation is built into how the XRP Ledger treats its native asset. XRP is not an issued token and has no issuer that can blacklist an account. The XRPL documentation states that freeze features apply to issued tokens held through trust lines, not to XRP itself. Ripple, the XRPL Foundation and validators therefore have no built-in authority to mark these native-XRP accounts as frozen, and a normal payment from an account holding sufficient XRP remains valid under the ledger's current rules.

Traceability is not control. The XRP Ledger makes every transfer public, yet that transparency does not give Ripple the authority to seize or lock native XRP held in another account.

The contrast is visible in the stablecoin portion of the same breach. CoinDesk reported that Circle and Tether had frozen about $320,000 in USDC and USDT tied to the incident. Those assets carry issuer-level blacklist controls. Native XRP does not, and that asymmetry is why the two parts of the same breach have followed such different recovery paths.

The Key Intervention Point Is the Exchange Deposit

Once XRP reaches an exchange-controlled address, the issue shifts from protocol rules to custodial control. The exchange can connect a tagged XRP deposit to a customer account, halt withdrawals or trading, preserve records and respond to investigators. At that stage, the outcome depends on the platform's own controls rather than on the ledger's rules.

The distinction matters particularly on the XRP Ledger because large exchanges commonly use shared deposit wallets. A destination tag tells the exchange which internal customer account should receive a payment. The tag is not public proof of a person's identity, but it creates a point where the platform can match an on-chain deposit with its own customer records.

A September 25 public-XRPL analysis traced one route from an original holding account through intermediary addresses toward Binance and MEXC deposit infrastructure. That does not prove those exchanges received or credited all later transfers, and neither platform should be described as having frozen funds without a public confirmation. It does show why on-chain alerts matter before a large balance reaches an exit.

The Holding Accounts Are Emptying Quickly

The exchange checkpoint is becoming more urgent because the original holding accounts are draining fast. They held around 70 million XRP at 04: UTC on September 26; roughly eight hours later, that balance was down to about 49 million XRP, according to CoinDesk's review. In another visible detail, one account failed to send roughly 521,000 XRP because it lacked sufficient funds, and a second account sent an identical amount to the intended recipient about an hour later.

That pattern supports the conclusion that the funds are being actively redistributed. It does not establish the reason for every transfer, whether a particular wallet belongs to a laundering service, or how much XRP has reached the market. Those questions require evidence beyond the ledger itself.

What can still be watched from the ledger is concrete: the pace of further outflows from the holding accounts, the size of what remains, and whether any destination address matches known exchange deposit infrastructure.

The decisive moment is not the next transfer between anonymous wallets. It is the first point at which a traceable XRP balance enters a service that knows who controls the account and can prevent it from leaving again.

This article is provided for informational purposes only and does not constitute financial, investment or legal advice. On-chain balances, wallet labels and exchange actions can change quickly as the investigation continues.