Sep 26, 2026, 8:56 a.m. EDT
2 min read
Summary
- The perpetrator behind the $387.5 million breach at Bitget transferred approximately $83 million worth of stolen XRP away from three holding addresses, while around $75 million remains in accounts that cannot be frozen based on the guidelines of the XRP Ledger.
- Trading platforms can place restrictions on accounts receiving the illicit XRP, but Ripple lacks the capability to halt transfers originating from addresses under the criminal’s control; meanwhile, Tether and Circle have independently frozen roughly $320,000 in associated stablecoins.
- Bitget announced that its user protection fund will absorb the deficit and customer funds remain safe, with platform withdrawals planned to reopen progressively starting September 28 through October 2.
The malicious actor responsible for the $388 million security incident at cryptocurrency platform Bitget has shifted about $83 million in stolen XRP from a trio of holding addresses, leaving another $75 million residing in accounts that are immune to freezes under the protocol’s current standards.
An aggregate of nearly 103 million XRP was drained from Bitget on Thursday and split among five distinct addresses. Based on an examination of XRP Ledger data by CoinDesk as of 12:41 UTC on Saturday, two separate accounts that initially contained 20 million XRP each were depleted to roughly 23 and 55 tokens respectively, while a third address dropped to approximately 5.8 million XRP.
XRP functions as the native asset of the XRP Ledger, which is the distributed ledger operated by blockchain payments firm Ripple. While the network permits issuers to freeze specific tokens they create on the ledger, this authority does not apply to the native XRP currency itself, meaning Ripple has no inherent mechanism to prevent the hacker from utilizing those funds.
Consequently, asset recovery efforts rely heavily on the subsequent destinations of the capital. Any trading platform receiving the pilfered XRP can lock the beneficiary’s account to block cash-outs, though they cannot freeze tokens while they sit inside an address governed by the attacker.
Tether and Circle, the issuers behind the dollar-pegged stablecoins USDT and USDC, have already frozen approximately $320,000 in digital assets tied to the hack, utilizing built-in smart contract functions that allow them to blacklist specific wallet coordinates.
Read More: Circle and Tether step in to freeze hacker wallet after massive Bitget crypto heist
The pace of XRP movements picked up drastically overnight. At 04:32 UTC on Saturday, roughly 70 million tokens remained inside the initial five addresses, but about eight hours later that total dropped to 49 million.
Certain transactions retraced paths previously utilized by the first address. After a transaction involving roughly 521,000 XRP failed due to a lack of gas or funds in that specific origin account, the second address routed an identical amount to the intended destination about an hour later.
At this point, nearly 54 million XRP has departed the primary holding addresses, demonstrating that the wrongdoer is dispersing the stolen capital across a broader network of wallets, though the exact amount liquidated remains unknown.
XRP exchanged hands near $1.54 on Saturday, marking a 24-hour decline of roughly 4% while maintaining a weekly advance of about 9% according to data from CoinGecko.
At that market valuation, the initial stockpile of stolen XRP equaled roughly $160 million, representing about 4% of the asset’s stated $4.4 billion daily trading volume. The extent to which an outright sale would impact market prices hinges entirely on active buy orders present at the time of execution.
Bitget revised its aggregate theft figures upward to $387.5 million on Friday after factoring in TRON and Zcash transactions that were omitted from preliminary tallies, noting that this higher valuation represented assets compromised during the initial breach rather than a subsequent attack.
In the interim, the exchange verified that its insurance and protection reserve will cover the deficit without impacting user balances, scheduling Bitcoin withdrawals for September 28, Ether for September 29, USDT for September 30, and all remaining assets for October 2.
The Definitive Stablecoin Landscape Series: Asia Pacific
As stablecoins move into regulated finance, APAC is becoming a key proving ground. This report maps the region’s rules, use cases, and RLUSD’s role.
Sep 15, 2026
Why it matters:
Originally published at https://www.coindesk.com/markets/2026/09/26/bitget-hacker-moves-usd83-million-in-stolen-xrp-that-ripple-cannot-freeze.
