Bitget Hacker Moves $83M in XRP That Ripple Cannot Freeze
The attacker behind the $387.5 million Bitget breach is moving stolen XRP out of its holding wallets. Here is why nobody can freeze it, and what happens on Sunday.
The attacker behind the $387.5 million hack of crypto exchange Bitget has started moving the stolen XRP. On-chain data shows about $83 million worth of XRP left three of the attacker's holding wallets between Friday night and Saturday, and roughly $75 million more still sits in accounts the attacker controls. Unlike stablecoins such as USDT, there is no one who can freeze that XRP.
Key takeaways
- Nearly 103 million XRP was taken in the Bitget breach, split across five accounts.
- About $83 million of it moved out on 25 and 26 September; two of the wallets are now almost empty.
- Ripple cannot block XRP on the XRP Ledger. Only exchanges that receive the coins can lock the receiving accounts.
- Circle and Tether froze about $320,000 in USDC and USDT tied to the attack.
- Bitget says customer balances are covered, and Bitcoin withdrawals restart on 28 September at 08:00 UTC (1:30 pm IST).
What moved, and when
Bitget found the breach on 24 September. The exchange later raised its estimate of the loss from $351.6 million to about $387.5 million. XRP was the biggest single piece: close to 103 million tokens, worth around $160 million at a price of $1.54.
Transfers out of the holding wallets picked up overnight on Friday. By early Saturday (UTC), about 70 million XRP was still in place. By Saturday afternoon, two of the accounts had been drained to a few dozen tokens each, and a third was down to about 5.8 million XRP. That leaves roughly $75 million still parked, which could move at any time.
Why Ripple cannot freeze XRP
People often assume Ripple, the company, controls XRP. It does not work that way. The XRP Ledger does have a freeze feature, but it applies only to tokens that a company issues on the ledger, such as a stablecoin. XRP itself is the ledger's native coin, and no single party can block an account from spending it.
So the only way to stop the stolen coins is at the edges. When the XRP lands at an exchange, that exchange can flag the deposit, lock the account and refuse withdrawals. That is why security teams track the attacker's wallets so closely: every hop to a centralised exchange is a chance to catch the funds.
Stablecoins are different. USDT and USDC have blacklisting built in, which is how Circle and Tether were able to freeze about $320,000 linked to the breach within days. It is a small share of the total, but it shows the gap between issuer-controlled tokens and open networks like XRP, Bitcoin or Ethereum.
Are Bitget users affected?
Bitget says it will cover the loss from its own protection fund and that customer balances are not affected. The exchange's chief executive, Gracy Chen, said the attacker got into a backend system and faked transaction data, rather than stealing private keys. She said the patterns looked similar to groups previously linked to North Korea, but that has not been confirmed and the investigation is still open. Bitget has also offered a bounty of up to 10% for help recovering the funds.
Withdrawals, paused since the hack, return in stages. All times below are in UTC, with India time in brackets:
- 28 September, 08:00 (1:30 pm IST): Bitcoin on the Bitcoin network
- 29 September, 08:00 (1:30 pm IST): ETH on Ethereum, BSC, Arbitrum, Base and Optimism
- 30 September, 08:00 (1:30 pm IST): USDT on Ethereum, BSC, Solana and Tron
- 2 October, 08:00 (1:30 pm IST): other tokens, fiat and P2P
Gracy Chen is due to host a live session for users at 07:30 UTC (1 pm IST) on 28 September, just before Bitcoin withdrawals reopen.
What it means for Indian users
If you have funds on Bitget, expect a rush when each coin reopens, and possibly slow processing. Withdraw in the order the schedule allows rather than trying the same coin over and over. Watch out for fake "withdrawal helper" links and support accounts on Telegram or X: scammers follow every big hack. Only use the official Bitget app or website.
Offshore exchanges also carry an extra layer of risk for Indians. Several are not registered with the FIU in India, which means no local recourse if things go wrong. Our guide to crypto hacks and how to stay safe explains why keeping long-term holdings in your own wallet matters; see hot wallet vs cold wallet to choose one.
XRP itself has held up well so far. One XRP is worth about ₹143.01 right now; follow it on our XRP price in INR page. For the earlier details of the breach, read Bitget hack loss rises to $387M.
FAQ
Can Ripple freeze stolen XRP?
No. XRP is the native coin of the XRP Ledger, and the ledger's freeze feature only covers tokens issued by companies on it. Exchanges can lock accounts that receive stolen XRP, but nobody can stop the attacker's own wallet from sending it.
When can I withdraw Bitcoin from Bitget?
From 28 September 2026 at 08:00 UTC, which is 1:30 pm in India. ETH follows a day later, USDT on 30 September and all other tokens on 2 October.
Will Bitget users lose money?
Bitget says it will cover the loss from its protection fund and that customer balances are unaffected. Keep records of your balances in case you need to raise a claim.
This article is AI-assisted, educational and general in nature. It is not financial advice and never a guarantee of profit. Every trade is at your own risk on your own exchange. See our risk disclosure and editorial policy.
