Ripple's XRP ecosystem is navigating two sharply contrasting developments this week. Stolen funds from the Bitget breach continue to move across the XRP Ledger, while Ripple's RLUSD stablecoin closes in on $2.5 billion in circulation. Taken together, the stories highlight a structural difference between native XRP and issuer-controlled tokens on the same ledger.

Stolen XRP keeps moving

According to CoinDesk, the attacker behind Bitget's $387.5 million breach has moved roughly $83 million in stolen XRP out of three of the original wallets. Approximately $75 million remained spread across the five original XRP holding accounts as of Sept. 28.

Nearly 103 million XRP was taken in the Sept. 24 incident and subsequently divided among several wallets. On-chain movements show that the attacker has redistributed a significant share of the haul, although transfers alone do not prove that the XRP has been sold. Because the ledger's transaction history is fully public, each wallet-to-wallet hop remains traceable by anyone monitoring the chain.

Why Ripple cannot freeze native XRP

Ripple has no ability to freeze native XRP because the token is the built-in asset of the XRP Ledger. Ripple says it does not control the ledger and cannot reverse transactions.

The distinction matters because tokens issued on the ledger can carry issuer-level controls. Centralized stablecoin issuers can also blacklist addresses in certain circumstances — Tether and Circle, the issuers behind the two largest dollar stablecoins, have both frozen addresses tied to hacks and sanctions. Ripple's own RLUSD terms permit the company to freeze or burn RLUSD held in specific wallets when required by law or its compliance policies.

RLUSD approaches a new milestone

Meanwhile, RLUSD — the dollar-pegged stablecoin Ripple launched in December 2024 on the XRP Ledger and Ethereum — has continued to expand its circulation. Ripple's latest transparency report showed $2.3956 billion of RLUSD in circulation as of Sept. 3, backed by $2.5177 billion in reserve funds. Market trackers have since placed the circulating supply near $2.5 billion. Reserve disclosures of this kind are standard practice among major stablecoin issuers, and circulating supply is a widely cited measure of a stablecoin's scale.

The growth reflects additional issuance rather than a meaningful move in the stablecoin's dollar price, which is designed to stay close to $1.

An unusual week for the XRP Ledger

The contrast presents an unusual stretch for the XRP Ledger. Stolen native XRP can keep moving between self-custodied wallets with no issuer-level freeze available. RLUSD, by comparison, runs with controls that give its issuer far greater intervention capabilities.

For exchanges and investigators, that difference makes the destination of the stolen XRP increasingly important. Once the funds reach a centralized platform, that platform may be able to restrict the associated account. Until then, the ledger's rules leave native XRP outside Ripple's direct freezing authority, and any further hop — or deposit to an exchange — will play out in public, on-chain, where it can be observed as it happens.