Bitget Attacker Moves $83M in Stolen XRP; Ripple Cannot Freeze Tokens

Theft and Movement Timeline

Bitget's attacker has transferred approximately $83 million in stolen XRP across multiple wallets, with two accounts nearly emptied and a third currently being drained, according to CoinDesk. CryptoSlate reported that roughly 27 million XRP tokens moved during the incident, though the precise timing and total stolen amount differ between sources. About $75 million remains across the five original holding accounts where the tokens were initially placed, per CoinDesk.

Exchange Response and On-Chain Reality

Bitget halted XRP withdrawals on September 26 in response to the theft. However, the stolen tokens continue to move on-chain without triggering a measurable sale on spot markets, according to Bitquery data cited by CryptoSlate. The attacker's ability to move the XRP freely underscores a key difference between XRP and tokens like USDC or USDT: Ripple lacks the technical ability to freeze or claw back tokens once they leave the exchange, even if the company identifies the wallet addresses involved. Most stablecoins include freeze functionality in their smart contracts, allowing issuers to immobilize flagged tokens.

Implications for Asset Security

The incident highlights the structural difference between native Layer 1 tokens and programmable stablecoins. While Bitget's withdrawal freeze can temporarily contain contagion, it does not prevent the attacker from moving XRP to other exchanges, mixing services, or OTC counterparties. The stolen funds remain at risk of being laundered across multiple platforms unless law enforcement or exchanges take coordinated action to identify and block the attacker's downstream addresses.