Bitget hacker moves $83 million in stolen XRP that Ripple cannot freeze

The hacker responsible for the recent Bitget breach has transferred approximately $83 million worth of XRP from three of the five original holding wallets. About $75 million still sits in accounts that are not subject to freezing under the XRP Ledger’s protocol.

Movement of stolen XRP

Bitget reported that 103 million XRP were taken and split across five wallets. By Saturday morning two of the wallets, each initially holding around 20 million XRP, were reduced to roughly 23 tokens and 55 tokens respectively, while a third wallet fell to about 5.8 million XRP. Overnight transfers dropped the remaining balance from roughly 70 million to 49 million XRP, indicating the attacker is redistributing the funds.

Ripple’s limited control

Although Ripple can freeze tokens it issues on the XRP Ledger, that authority does not extend to the native XRP token. Consequently, Ripple cannot block the attacker from moving or spending the stolen XRP while it remains in the hacker‑controlled wallets.

Exchange and stablecoin responses

Exchanges that receive the stolen XRP can restrict the recipient’s account and halt withdrawals, but they cannot freeze the coins themselves. Circle and Tether have already frozen about $320,000 in USDC and USDT linked to the breach, using their built‑in address‑blacklisting capabilities.

Bitget’s remediation

Bitget confirmed that its protection fund will cover the loss, leaving customer balances unaffected. Withdrawals are set to resume in stages from September 28 through October 2, starting with Bitcoin and followed by Ether, USDT, and other tokens.

Market impact

At the time of reporting, XRP traded around $1.54, down about 4 % over 24 hours but still up roughly 9 % for the week. The original XRP haul represented about 4 % of the token’s daily trading volume of $4.4 billion.