Bitget Hacker Moves $83 Million XRP Revealing Ripple Cannot

Stolen XRP worth $83 million moved out of wallets tied to the Bitget hack on Saturday, as the attacker drained two addresses almost completely and began emptying a third.

Key Takeaways

Stolen XRP worth $83 million moved from wallets tied to the Bitget hack on Saturday
About $75 million remained across the five original holding accounts as of the transfers
XRP has no issuer-level mechanism to freeze tokens or reverse transfers after they leave an exchange’s custody
Blockchain analysts are tracking remaining funds for possible routing through mixers or bridges to other chains

About $75 million remained across the five original holding accounts as of the transfers, according to a CoinDesk report published Saturday. The exploit itself dates to a broader breach that drained $350 million from Bitget wallets, a theft Fathom covered as it unfolded this week.

Ripple, the company behind the XRP (XRP) token and its underlying ledger, does not control a mechanism to freeze XRP tokens the way stablecoin issuers can freeze USDT or USD Coin (USDC).

That distinction matters here.

Centralized stablecoins like Tether (USDT)’s USDT carry issuer-level blacklist functions, letting Tether halt movement of tokens flagged as stolen or sanctioned. XRP has no equivalent function built into its consensus rules, so once tokens leave an exchange’s custody, the issuer has no lever to pull.

Why A Ledger’s Design Decides Who Gets Their Money Back

The XRP Ledger settles transactions through a consensus protocol run by independent validators, not by Ripple itself.

Ripple holds a large XRP reserve and influences the network’s direction, but it does not sit as a central custodian able to reverse or freeze transfers.

That structure is precisely why the Bitget hacker can move funds freely. Exchanges hit by similar hacks involving Circle’s USDC have sometimes recovered stolen funds within hours because Circle can freeze addresses on request from law enforcement.

XRP holders have no such backstop, leaving recovery entirely dependent on the hacker eventually routing funds through a compliant exchange that can flag and hold them.

From $350 Million Breach To A Slow Drain

The Bitget hack that produced this XRP first surfaced days earlier, when wallets tied to the exchange lost roughly $350 million across multiple assets in a breaking exploit. That initial event triggered exchange-wide security reviews and drew comparisons to earlier custody failures at other major platforms.

The current $83 million XRP movement represents the attacker cashing out a slice of that larger haul, more than a week after the original breach, suggesting the hacker is laundering funds in stages rather than all at once.

Also Read: Bitget Wallets Lose $180M In Suspected Breach, On-Chain Data Shows

What Investigators Are Watching Next

Blockchain analysts are tracking the remaining $75 million still sitting in the five original wallets, watching for signs the attacker will route funds through mixers or bridge them to other chains.

Bitget has not disclosed whether it has engaged law enforcement to flag the destination addresses to exchanges that could freeze deposits on arrival.

The core lesson for XRP holders is structural rather than incident-specific. Any theft on the XRP Ledger carries a lower probability of recovery than a theft involving a centralized stablecoin, a gap that has drawn renewed attention as exchange hacks continue into late 2026.