Bitget hacker moves $83 million in stolen XRP that Ripple cannot freeze
Sep 26, 2026, 8:56 a.m. EDT
2 min read
Summary
- The hacker behind Bitget’s $387.5 million breach moved about $83 million in stolen XRP from three holding wallets, while roughly $75 million remains in accounts that cannot be frozen under the XRP Ledger’s rules.
- Exchanges can restrict accounts that receive the stolen XRP, but Ripple cannot block transactions from wallets controlled by the attacker; Circle and Tether have separately frozen about $320,000 in related stablecoins.
- Bitget said its protection fund will cover the losses and customer balances are unaffected, with withdrawals scheduled to resume in stages from Sept. 28 through Oct. 2.
The hacker behind crypto exchange Bitget’s $388 million breach has moved about $83 million in stolen XRP out of three holding wallets, leaving another $75 million in accounts that cannot be frozen under the network’s existing rules.
Nearly 103 million XRP was taken from Bitget on Thursday and divided among five accounts. By 12:41 UTC Saturday, two accounts that initially held 20 million XRP each had been reduced to about 23 and 55 tokens, according to CoinDesk’s review of XRP Ledger records. A third was down to about 5.8 million XRP.
XRP is the currency built into the XRP Ledger, the blockchain used by payments company Ripple. The network lets companies freeze tokens they issue on it, but that power does not extend to XRP itself. Ripple has no built-in way to block the attacker from spending those coins.
That leaves recovery efforts dependent in part on where the money goes next. An exchange receiving stolen XRP can restrict the recipient’s account and prevent withdrawals. It cannot freeze coins while they remain in a wallet controlled by the attacker.
Circle and Tether, the companies behind dollar-linked tokens USDC and USDT, have already frozen about $320,000 in stablecoins connected to the breach. Their tokens contain controls that allow the companies to blacklist addresses.
Read More: Circle and Tether step in to freeze hacker wallet after massive Bitget crypto heist
The XRP transfers accelerated overnight. At 04:32 UTC Saturday, about 70 million tokens remained in the original five accounts. Roughly eight hours later, that balance had fallen to 49 million.
Some payments followed routes already used by the first wallet. After an attempted transfer of about 521,000 XRP failed because that account lacked sufficient funds, the second sent an identical amount to the intended recipient roughly an hour later.
About 54 million XRP has now left the original holding accounts. The transfers show the attacker distributing the stolen funds across more wallets, although they do not reveal how much has been sold.
XRP traded around $1.54 on Saturday, down about 4% over 24 hours while retaining a weekly gain of about 9%, according to CoinGecko.
At that price, the original XRP haul was worth roughly $160 million, or equivalent to about 4% of the token’s $4.4 billion in reported daily trading volume. How much a sale would move the price depends on the buy orders available when it happens.
Bitget raised its estimate of the overall theft to $387.5 million on Friday after including Zcash and TRON transfers missed in its initial accounting. It said the higher figure reflected assets taken during the original breach, rather than another attack.
Meanwhile, the exchange has since confimed its protection fund covers the loss and customer balances remain unaffected. Bitcoin withdrawals are scheduled to resume Sept. 28, followed by ether on Sept. 29, USDT on Sept. 30 and other tokens on Oct. 2.
- 1
- 2
- 3
- 4
- 5
- 6
- 7
- 8
- 9
- 10
The Definitive Stablecoin Landscape Series: Asia Pacific
The Definitive Stablecoin Landscape Series: Asia Pacific
As stablecoins move into regulated finance, APAC is becoming a key proving ground. This report maps the region’s rules, use cases, and RLUSD’s role.
Sep 15, 2026
As stablecoins move into regulated finance, APAC is becoming a key proving ground. This report maps the region’s rules, use cases, and RLUSD’s role.
Why it matters:
As stablecoins move into regulated finance, APAC is becoming a key proving ground. This report maps the region’s rules, use cases, and RLUSD’s role.
View Full Report