Funds on the Move as Recovery Options Narrow

The attacker behind the Bitget exchange breach has moved roughly $83 million in stolen XRP out of three original holding wallets, complicating what was already a difficult recovery effort. Approximately 54 million XRP, worth around $83 million at Saturday's prices, has since left those original wallets, leaving about 49 million XRP worth roughly $75 million.

Nearly 103 million XRP was taken in Thursday's attack and split among five accounts. Two accounts that initially held 20 million XRP each were nearly emptied, with balances of about 23 and 55 XRP, while a third held approximately 5.8 million XRP. The transfers indicate that the attacker is spreading the stolen tokens across additional addresses, although the movements alone do not show how much XRP has actually been sold.

Why Ripple Cannot Step In

The core problem facing investigators and Bitget is structural. XRP cannot be frozen by any entity or individual. The XRP Ledger is decentralized so that no one party has control over it, not Ripple, not the XRP Ledger Foundation, and not anyone else. The XRP Ledger includes freeze functionality for issued tokens, allowing an issuer to restrict assets it created under certain conditions, but its official documentation explicitly states that this functionality does not apply to XRP and that no entity can freeze native XRP held in an independent wallet. That leaves centralized exchanges as one of the few chokepoints where stolen funds could potentially be intercepted, if and when the attacker attempts to cash out through a platform that can restrict associated accounts.

Circle and Tether, the companies behind dollar-linked tokens USDC and USDT, have already frozen about $320,000 in stablecoins connected to the breach. Their tokens contain controls that allow the companies to blacklist addresses, a capability that does not exist for native XRP.

Bitget revised its estimate of the overall theft to $387.5 million after accounting for Zcash and TRON transfers omitted from its first tally. The exchange said the revision reflected assets stolen in the original breach, rather than a second attack. Bitget says its protection fund covers the loss and customer balances remain unaffected. It scheduled Bitcoin withdrawals to resume on September 28, followed by Ether on September 29, USDT on September 30, and other tokens on October 2.

Sources:
CoinDesk: Bitget hacker moves $83 million in stolen XRP beyond reach of freeze controls
XRP Ledger: Common Misunderstandings about Freezes
FinanceFeeds: Bitget Hacker Moves $83M of Stolen XRP; $75M Still Parked