Bitget Hacker Moves $83 Million in Stolen XRP That Ripple Cannot Freeze

The attacker is draining five wallets holding XRP from the Bitget exchange breach, exposing a critical gap in Ripple's freeze mechanism that leaves $83 million beyond the reach of recovery tools.

A hacker who breached the Bitget cryptocurrency exchange is actively moving $83 million worth of stolen XRP tokens, and Ripple Labs' built-in freeze function — designed to halt suspicious transactions — cannot stop the drain. Two of the five wallets containing the stolen funds have been almost completely emptied, and a third is currently being drained, with approximately $75 million remaining across the accounts as of Saturday morning.

The theft highlights a critical vulnerability in how Ripple's freeze mechanism works. While Ripple can freeze XRP held in accounts it directly controls or has flagged through its freeze list, the stolen tokens appear to be held in standard user wallets that fall outside this infrastructure. The XRP Ledger's design allows Ripple to freeze tokens only if they are held by gateways or accounts that have opted into the freeze feature, leaving privately held wallets immune to this intervention.

Bitget has not publicly disclosed the total value of XRP stolen in the breach, but blockchain data shows five wallets linked to the attack held approximately $83 million worth of the token before the current draining operation began. The attacker has been methodically emptying the wallets in batches, likely to evade detection or to test the limits of exchange surveillance systems before moving the full amount.

For XRP holders, the incident raises uncomfortable questions about the balance between decentralization and security. Ripple has long promoted its freeze function as a safeguard against theft and fraud, but the feature only applies to a narrow subset of the network. Tokens held in self-custody wallets or on exchanges that do not integrate with Ripple's freeze infrastructure remain vulnerable, and once stolen, they can be moved freely across the XRP Ledger without intervention.

Exchange users affected by the Bitget breach are unlikely to recover their funds directly from the blockchain. Instead, recovery will depend on whether Bitget's insurance reserves or corporate balance sheet can absorb the loss, or whether law enforcement can trace and seize the stolen funds after they leave the XRP Ledger. The latter option is complicated by the speed at which the hacker is moving the tokens and the difficulty of tracking cross-chain transfers once the XRP is converted into other assets.

The ongoing drain also puts pressure on other exchanges to review their cold storage and wallet security protocols. If the hacker successfully converts the stolen XRP into harder-to-trace assets like privacy coins or moves it into decentralized exchanges, the trail will go cold quickly. For now, blockchain watchers are monitoring the remaining $75 million in the affected wallets, waiting to see if the attacker accelerates the withdrawals or if any exchange or on-chain intervention can halt the flow.