Bitget hacker moves $83M in stolen XRP that Ripple cannot freeze
By Crypto Wire
September 26, 2026
The attacker behind Bitget’s roughly $387.5 million breach has moved about $83 million in stolen XRP out of three holding wallets, CoinDesk reported September 26 from XRP Ledger records, while roughly $75 million remains across the five original holding accounts that Ripple cannot freeze under native XRPL rules. Nearly 103 million XRP was taken Thursday and split among five accounts. Attribute the move size, remaining balance, and freezability caveat to CoinDesk’s Saturday ledger review—do not invent that Ripple can claw back native XRP from attacker-controlled wallets.
What the Saturday ledger showed. By 12:41 UTC, two accounts that initially held 20 million XRP each had been reduced to about 23 and 55 tokens; a third was down to about 5.8 million XRP, per CoinDesk. About 54 million XRP has left the original holding set. Overnight acceleration was sharp: at 04:32 UTC Saturday about 70 million tokens remained in the five accounts; roughly eight hours later that balance had fallen to 49 million. Some payments reused routes from the first wallet—after an attempted ~521,000 XRP transfer failed for insufficient funds, a second wallet sent the same amount about an hour later.
Why native XRP sits outside issuer freeze tools. XRPL lets issuers freeze tokens they issue, but that power does not extend to XRP itself. Ripple has no built-in way to block the attacker from spending those coins while they remain in wallets the attacker controls. Recovery therefore depends partly on where funds go next: an exchange that receives stolen XRP can restrict the recipient account and stop withdrawals, but it cannot freeze coins still sitting in attacker wallets. Circle and Tether have separately frozen about $320,000 in related USDC/USDT because those stablecoins include blacklist controls—already filed earlier as the $318K-class freeze desk, now restated by CoinDesk’s Saturday wrap.
Price and volume color without inventing an executed dump. XRP traded around $1.54 Saturday, down about 4% over 24 hours while retaining a weekly gain near 9%, per CoinGecko via CoinDesk. At that price the original XRP haul was worth roughly $160 million, or about 4% of the token’s reported $4.4 billion daily trading volume. CoinDesk notes the transfers show distribution across more wallets and do not reveal how much has been sold—do not invent a confirmed market sell-through.
Bitget’s own status remains the operational backdrop, not a reprint of prior withdrawal desks. The exchange raised the overall theft estimate to $387.5 million Friday after including Zcash and TRON missed in the first count, said the higher figure reflects the original breach rather than a second attack, and reiterated that its protection fund covers losses with customer balances unaffected. Bitcoin withdrawals are still scheduled September 28, ether September 29, USDT September 30, and other tokens October 2—already on the wire as LN 9755.
Rejected near-echos for this tick. Bitget’s phased withdrawal calendar is LN 9755. The ~$157 million native XRP freeze-limit policy file is LN 9715. Circle/Tether’s ~$318K stablecoin freeze is LN 9737. The $387.5 million / 5% bounty raise is LN 9739. Ethena ending USDe-linked ENA incentives and Backpack’s 10,000-symbol Solana stock target (LN 9774) stay alternate unused angles—held so this slot takes CoinDesk’s unused Saturday XRP-movement ledger story. Quit’s Limit Break reclaim portal remains LN 9761.
Why Rug Room 52 plus Latest News 16 (no Editor’s Pick—Sep 26 OC EP already 5/5). An on-ledger move of ~$83 million stolen native XRP that Ripple cannot freeze is unused security tape distinct from the withdrawal calendar and earlier freeze-policy files. Desk 52 was unused today among least-used standouts. Author is Crypto Wire for desk 52. Publicize stays off.
What not to invent: that Ripple froze or can freeze the remaining native XRP, that the ~$83 million move equals confirmed exchange dumps, a disclosed next CEX destination for every hop, or that Bitget’s protection-fund coverage equals recovered coins. Stick to CoinDesk / XRPL / CoinGecko attributions for the five-wallet drawdown, ~54 million XRP departed, ~$75 million still parked, and the $320K stablecoin freeze contrast.
Bottom line: CoinDesk’s Sep. 26 ledger review shows Bitget’s attacker moved about $83 million in stolen XRP while ~$75 million remains unfreezable under XRPL rules—unused Rug Room news for Sep 26 OC.
Disclaimer: This article is provided for informational and educational purposes only. It does not constitute financial, investment, legal, or trading advice. The NFT market is highly volatile, and past performance is not indicative of future results. Readers should conduct their own research and consult qualified professionals before making any decisions related to digital assets. The cover image for this article may have been created using artificial intelligence (AI).
