Ripple's Helplessness: Why $83 Million in Stolen XRP Simply Vanishes

The Bitget hacker's got XRP, and there's precisely nothing Ripple can do about it.

After spoofing transaction data to trick Bitget's backend into signing off fraudulent transfers on September 24, the attacker walked away with nearly 103 million XRP—worth around $157 million at the time. Within 36 hours, they'd already moved roughly half of it. Eighty-three million dollars gone in just over a day, funnelled into fresh wallets faster than Ripple could blink.

The total Bitget breach hit $387.5 million across multiple blockchains. But the XRP piece is the interesting one. Because here's the thing: Ripple's network has a freeze mechanism. It works beautifully on stablecoins. Circle and Tether blacklisted $318,000 in USDC and USDT within hours. Problem solved.

Except XRP itself can't be frozen. It's the ledger's native asset, so the freeze authority doesn't apply. No built-in kill switch. No way to block the attacker's wallets. Once stolen XRP leaves the original addresses, Ripple's tools are useless.

This creates a strange asymmetry. Exchanges can freeze accounts once the hacker deposits stolen XRP there. They can block withdrawals. But until that moment—when the attacker actually tries to cash out—the thief has total mobility. Complete freedom. The blockchain's supposed immutability becomes a liability when you're trying to recover stolen funds.

The attacker clearly understands this. Instead of dumping all 103 million XRP at once, they're trickling it across multiple new wallets. Strategic. Methodical. Two wallets that started with 20 million each got drained down to nearly nothing—23 tokens in one, 55 in the other. A third wallet dropped to 5.8 million. The pace accelerated overnight: 70 million XRP remaining on Saturday morning became 49 million by Saturday afternoon.

Larger increments. Growing confidence. Someone readying an exit strategy.

Bitget's handling the financial part competently. The exchange's protection fund holds $464 million, well above the $387.5 million loss, so customer balances stay intact. Withdrawals are resuming in phases—Bitcoin on September 28, Ethereum on September 29, Tether on September 30, everything else by October 2. They've even launched a recovery bounty: 5 percent rewards for information leading to fund recovery.

But that's reactive gatekeeping. It only works if the attacker tries to convert the XRP back into fiat or move it to another blockchain. Until then, the recovery bounty is largely performative.

The Bitget incident reveals a structural gap in blockchain security that nobody really wants to discuss. Tokens with built-in freezes—stablecoins, most regulated assets—can be immobilized at the contract level. Native assets just move. Free as air. Uncontrollable once stolen.

It's a problem that puts all the burden on exchanges. On reactive measures. On hoping the attacker eventually surfaces at a place where you can catch them.

Source & further reading:

• Bitget hacker moves $83 million in stolen XRP that Ripple cannot freeze — CoinDesk
• Kraken’s parent Payward is betting billions on becoming financial infrastructure, not just a crypto exchange — CoinDesk
• Binance deal gives Circle a boost in stablecoin race with Tether, analysts say — CoinDesk
• Bitcoin could soon get Zcash-style 'shielded' privacy without changing its rules — CoinDesk
• Solana’s 150-millisecond settlement upgrade reaches second public test network — CoinDesk
• Ripple cannot freeze native XRP as Bitget hacker moves $83 million in stolen assets — PANews
• Bitget Hacker Moves $83M in Stolen XRP as Ripple Cannot Freeze Funds — Altcoin Buzz
• Circle and Tether Freeze Stablecoins Tied to Bitget Hack—But Most Funds Slip Away — Decrypt
• Bitget Hack Losses Climb to $387M: Here's What Happened, and Why North Korea Is a Suspect — Decrypt