The Bitget hacker is moving fast, and nobody can hit the brakes. About $83 million in stolen XRP has left the attacker's original holding wallets, and Ripple has confirmed it cannot freeze the funds because XRP is the ledger's native asset, outside every freeze tool the network has.
A CoinDesk review of XRP Ledger records found roughly 54 million XRP had exited the five original holding accounts by Saturday. Two accounts that started with 20 million XRP each were drained to about 23 and 55 tokens, while a third shed around 5.8 million XRP. Nearly 103 million XRP was taken across five accounts in the first place, and about 54 million has already been pushed onward to fresh wallets, NewsBytes reported.
Related reading: Bitget confirms $351.6M hack, blames North Korea-linked attackers; Bitget hacker cashes out via Binance as exchange posts 5% bounty.
Why Ripple cannot stop it
The freeze function on the XRP Ledger applies only to tokens issued on the network through trust lines. XRP itself has no issuer, so there is no blacklist button for Ripple, the XRPL Foundation or validators to press. A payment from an account holding sufficient XRP simply stays valid under current rules, Coindoo reported.
Traceability is not control. Every hop is visible on the public ledger, yet visibility grants nobody the power to seize or lock native XRP sitting in someone else's wallet.
The stablecoin contrast
The same breach shows what issuer control looks like: Circle and Tether froze about $320,000 in USDC and USDT tied to the incident within hours. Those assets ship with issuer-level blacklist controls. Native XRP does not, by design, and that design choice now carries a visible cost.
That leaves one checkpoint that matters: exchanges. If the stolen XRP lands on a centralized platform, the venue can restrict the linked accounts and block withdrawals. Until then, the funds keep moving.
Losses grow to $387.5M as withdrawals near
Bitget raised its total damage estimate to about $387.5 million after folding in Zcash and TRON transfers missed in its first count, stressing the higher figure reflects the original breach rather than a second attack. Its protection fund of 5,500 BTC covers the loss while Bitcoin holds above $70,000, and customer balances are unaffected, BloomingBit reported.
Staged withdrawals are days away: Bitcoin on Sept. 28, Ether on Sept. 29 and Tether on Sept. 30. CEO Grace Chen blamed a critical backend flaw in wallet infrastructure that let the attacker tamper with transaction data and trigger Bitget's own authorization process. On-chain trackers also spotted about 457.9 ETH ($1.23 million) moving from Binance to an attacker-linked wallet.
What to watch
- The other $75M: about 49 million XRP still sits in the first five accounts and cannot be frozen there
- Exchange screens: the 5% bounty plus compliance teams make any centralized cash-out the riskiest hop
- Escrow release: Ripple's scheduled release of 1 billion XRP from escrow lands in about four days, adding supply noise to hack-flow watching
- Sept. 28-30: staged withdrawals test whether confidence, and the protection fund math, holds