SKN | Bitget Hacker Moves $83 Million in Stolen XRP as Ripple Cannot Freeze Native Tokens

Key Points:

• About $83 million worth of stolen XRP has been moved from three wallets linked to the Bitget breach, while roughly $75 million remains across the original holding accounts.
• Ripple cannot directly freeze native XRP because the XRP Ledger’s freeze mechanism applies to issued tokens rather than XRP itself.
• The incident highlights a critical distinction between blockchain traceability and asset-level control, leaving exchanges and other centralized gateways as important points for potential recovery.

The Bitget security breach has entered a new phase after the attacker moved approximately $83 million in stolen XRP from three wallets, increasing the difficulty of recovering the assets. The movement underscores a structural feature of the XRP Ledger: while transactions are publicly traceable, Ripple does not have a built-in mechanism to freeze native XRP held in an attacker-controlled wallet.

The development comes after roughly 103 million XRP was taken from Bitget on Thursday and distributed across five holding accounts. With cryptocurrency exchanges facing growing scrutiny over custody and security controls, the movement illustrates how the technical characteristics of different digital assets can materially affect post-hack recovery efforts.

More Than Half of the XRP Has Already Moved

According to CoinDesk’s review of XRP Ledger records, two of the five original wallets initially held approximately 20 million XRP each. By 12:41 UTC on Saturday, those balances had fallen to roughly 23 XRP and 55 XRP respectively, effectively emptying the two accounts.

A third wallet had been reduced to approximately 5.8 million XRP. Across the original five addresses, around $75 million worth of XRP remained, meaning a substantial portion of the stolen XRP had already been transferred elsewhere.

The scale of the movement matters because every subsequent transfer potentially increases the number of addresses that investigators and exchanges must monitor. At the same time, movement does not necessarily establish that the funds have been successfully converted into fiat or other assets.

Why Ripple Cannot Freeze Native XRP

The recovery challenge is closely tied to the architecture of the XRP Ledger. XRP is the network’s native asset rather than a token issued by Ripple. Consequently, Ripple does not possess an issuer-level blacklist or freeze function capable of preventing an attacker from transferring native XRP.

The distinction is important because the ledger still provides complete transaction visibility. Investigators can follow the movement of XRP between addresses, but traceability does not equal control. A wallet controlled by an attacker can continue sending XRP as long as the network’s normal transaction rules are satisfied.

Exchanges Become Critical Recovery Gateways

Centralized exchanges can provide a different layer of control. If stolen XRP reaches an exchange, that platform may identify the associated account, restrict withdrawals and cooperate with investigators. However, an exchange cannot retroactively freeze XRP while it remains in an external wallet controlled by the attacker.

The contrast was visible elsewhere in the Bitget incident. CoinDesk reported that Circle and Tether froze approximately $318,000 in USDC and USDT associated with a hacker wallet. Those stablecoins have issuer-level controls that allow their respective companies to blacklist addresses under applicable circumstances. Native XRP does not have the same mechanism.

Security Architecture Remains Under Scrutiny

Bitget has said the breach affected its wallet infrastructure rather than involving a direct private-key compromise. CEO Gracy Chen said attackers compromised a backend system, spoofed transaction data and triggered the authorization process to move assets. Bitget also said its user protection fund exceeds $464 million.

For institutional crypto participants, the episode therefore extends beyond XRP recovery. It raises broader questions about wallet infrastructure, transaction authorization, asset-specific controls and exchange-level monitoring. The ability to trace stolen assets is valuable, but the practical recovery path can differ substantially depending on whether the asset has issuer controls or exists as a native blockchain asset.

Attention will now remain on the approximately $75 million of XRP still associated with the original holding accounts and on where the already-moved funds travel next. Transfers into centralized exchanges could create new intervention points, while movement through additional self-custody wallets could make recovery more complicated. For crypto institutions, the case reinforces the importance of monitoring not only blockchain transactions but also the distinct control mechanisms governing each asset.