Bitget's Stolen XRP Hits the Road: $83M Gone, $75M Left, and Ripple's Freeze Button Is on Backorder 🧊

A hacker who drained roughly 103 million XRP from crypto exchange Bitget on Thursday has already moved about $83 million of the stolen funds out of three holding wallets, leaving an estimated $75 million still sitting in accounts that Ripple lacks the technical ability to freeze. By 12:41 UTC Saturday, two wallets that originally held 20 million XRP each had been reduced to about 23 and 55 tokens respectively, according to a review of XRP Ledger records, while a third account had fallen to roughly 5.8 million XRP.

XRP is the native currency of the blockchain operated by payments company Ripple. The network permits issuers to freeze tokens they create on the ledger, but that authority does not extend to XRP itself, leaving Ripple with no built-in mechanism to block the attacker from spending the coins. Recovery efforts are therefore largely dependent on where the funds are sent next, since receiving exchanges can restrict accounts that accept the stolen tokens but cannot freeze coins that remain in wallets controlled by the attacker. Circle and Tether, the issuers of dollar-linked stablecoins USDC and USDT, have already frozen approximately $320,000 in stablecoins tied to the breach, using blacklist controls built into their tokens.

The pace of transfers accelerated overnight, with about 70 million tokens still parked in the original five accounts at 04:32 UTC Saturday and roughly 49 million remaining eight hours later. Some of the movements mirrored routes used by the first wallet; after an attempted transfer of about 521,000 XRP failed due to insufficient funds, the second wallet sent an identical amount to the same recipient roughly an hour later. As of the latest tally, about 54 million XRP has now left the original holding accounts.

Bitget said its protection fund will cover customer losses, that balances remain unaffected, and that withdrawals will resume in stages from Sept. 28 through Oct. 2. The exchange initially disclosed the total theft at $387.5 million, later reported as $388 million, making it one of the larger exchange breaches on record. With Ripple unable to intervene on-chain, the remaining $75 million in stolen XRP now hinges on whether the hacker routes the funds into venues willing and able to flag them.