Millions

Cosmos

USDC

Arkham

<h2 id="strong-key-takeaways-strong"><strong>Key Takeaways</strong></h2>
<div class="light-yellow-block">
 <ul>
  <li><strong>About 54 million XRP left five attacker wallets.</strong></li>
  <li><strong>Ripple cannot freeze native XRP balances.</strong></li>
  <li><strong>Roughly 49 million XRP remains in the original accounts.</strong></li>
  <li><strong>Exchanges are the crucial recovery checkpoint.</strong></li>
 </ul>
</div>
<p>The stolen XRP is no longer sitting where it first landed. A <a href="https://www.coindesk.com/markets/2026/09/26/bitget-hacker-moves-usd83-million-in-stolen-xrp-that-ripple-cannot-freeze" rel="noopener noreferrer nofollow">CoinDesk review of XRP Ledger records</a> found that roughly 54 million XRP had left the five original accounts used to hold the Bitget haul by 12:41 UTC on September 26. Two accounts that began with 20 million XRP each had been reduced to about 23 and 55 XRP, while a third held roughly 5.8 million XRP.</p>
<p>About 49 million XRP, valued near $75 million at the time, remained in those first five accounts. That figure only counts the original holding accounts: funds that leave them can still be under the attacker’s control in newly created wallets. The on-chain question is whether the XRP reaches a service that can identify and stop the person controlling it.</p>
<p>To understand what the $83 million figure actually measures, it helps to separate the original theft from the later redistribution.</p>
<h2 id="the-five-original-wallets-show-only-the-first-stage">The five original wallets show only the first stage</h2>
<p>Public <a rel="noopener noreferrer nofollow">blockchain</a> records show that roughly 103 million XRP left two Bitget-linked XRPL accounts on September 24 and reached the address <a href="https://bithomp.com/explorer/rwNhefsz1UQEusxhCvHip3RANinWi4CTck" rel="noopener noreferrer nofollow"><code>rwNhefsz1UQEusxhCvHip3RANinWi4CTck</code></a>. Arkham has placed that address in its <a href="https://info.arkm.com/research/hacker-steals-350m-from-bitget-and-begins-on-chain-laundering" rel="noopener noreferrer nofollow">Bitget Hacker entity</a>.</p>
<p>The amount was then split among five holding accounts. The split confirms where the XRP first went. It cannot, by itself, show whether each later address belongs to the same operator, a laundering intermediary or an exchange customer.</p>
<div style="margin: 30px 0; border-top: 1px solid #cbd5e1; border-bottom: 1px solid #cbd5e1;">
 <div style="padding: 17px 0; border-bottom: 1px solid #e2e8f0;"><strong style="display: block; margin-bottom: 4px; color: #0f172a;">The original loss</strong><br><span style="color: #475569;">Roughly 103 million XRP was transferred from <a href="https://coindoo.com/bitget-breach-north-korea-link-probed-withdrawals-paused/" rel="noopener noreferrer nofollow">Bitget-linked wallets</a> into the attacker cluster.</span>
 </div>
 <div style="padding: 17px 0; border-bottom: 1px solid #e2e8f0;"><strong style="display: block; margin-bottom: 4px; color: #0f172a;">The latest visible movement</strong><br><span style="color: #475569;">About 54 million XRP had left the first five holding accounts by September 26.</span>
 </div>
 <div style="padding: 17px 0;"><strong style="display: block; margin-bottom: 4px; color: #0f172a;">The missing fact</strong><br><span style="color: #475569;">The public ledger cannot establish how much XRP has been sold or identify every beneficial owner behind the new accounts.</span>
 </div>
</div>
<p>Calling every transfer a “cash-out” would overstate the evidence. A movement between attacker-controlled wallets does not create new selling pressure by itself. Selling becomes a more concrete risk when the route reaches a centralized exchange, OTC desk, instant-swap service or another gateway that can turn XRP into a different asset or fiat money.</p>
<h2 id="ripple-cannot-freeze-a-native-xrp-balance">Ripple cannot freeze a native XRP balance</h2>
<p>The limitation is built into how the XRP Ledger treats its native asset. XRP is not an issued token and has no issuer that can blacklist an account. The <a href="https://xrpl.org/docs/concepts/tokens/fungible-tokens/common-misconceptions-about-freezes" rel="noopener noreferrer nofollow">XRPL documentation</a> states that freeze features apply to issued tokens held through trust lines, not XRP itself.</p>
<p>Ripple, the XRPL Foundation and validators therefore have no built-in authority to mark these native-XRP accounts as frozen. A normal payment from an account that holds sufficient XRP remains valid under the ledger’s current rules.</p>
<blockquote style="margin: 28px 0; padding: 20px 24px; border-left: 4px solid #2563eb; background: #f8fafc; color: #1e293b;">
 <p style="margin: 0;"><strong>Traceability is not control.</strong> The XRP Ledger makes the transfers public, yet that transparency does not give Ripple authority to seize or lock native XRP held in another account.</p>
</blockquote>
<p>The contrast is visible in the stablecoin portion of the same breach. <a href="https://www.coindesk.com/markets/2026/09/25/circle-and-tether-step-in-to-freeze-hacker-wallet-after-massive-bitget-crypto-heist" rel="noopener noreferrer nofollow">CoinDesk reported</a> that Circle and Tether had frozen about $320,000 in USDC and USDT tied to the incident. Those assets include issuer-level blacklist controls. Native XRP does not.</p>
<h2 id="the-important-intervention-point-is-the-exchange-deposit">The important intervention point is the exchange deposit</h2>
<p>Once the XRP reaches an exchange-controlled address, the issue changes from protocol rules to custodial control. The exchange can connect a tagged XRP deposit to a customer account, stop withdrawals or trading, preserve records and respond to investigators.</p>
<p>This distinction is especially relevant on the XRP Ledger because large exchanges commonly use shared deposit wallets. A destination tag tells the exchange which internal customer account should receive a payment. The tag is not public proof of a person’s identity, but it creates a point where the platform can match an on-chain deposit with its own customer records.</p>
<p>A September 25 <a href="https://entrycrypto.com/analysis/bitget-hack-xrp-cash-out-binance-mexc" rel="noopener noreferrer nofollow">public-XRPL analysis</a> traced one route from an original holding account through intermediary addresses toward Binance and MEXC deposit infrastructure. That does not prove those exchanges received or credited all later transfers, and neither platform should be described as having frozen funds without a public confirmation. It does show why on-chain alerts matter before a large balance reaches an exit.</p>
<div class="read-more pb-3 pt-3 pt-md-2 px-3 my-4 border bg-light">
 <h5 class="text-uppercase border-bottom mb-3 pb-1 d-none d-md-block">READ MORE:</h5><a href="https://coindoo.com/how-cosmos-hub-stopped-and-restarted-to-seize-stolen-atom/" rel="noopener noreferrer nofollow">
  <div class="contentRight col-4"><span><img src="https://coindoo.com/wp-content/uploads/2025/07/blockchain-image-for-0f3.jpg"></span>
  </div>
  <div class="contentLeft col-8">
   <h4 class="title mb-0">How Cosmos Hub Stopped and Restarted to Seize Stolen ATOM</h4>
  </div></a>
</div>
<h2 id="the-holding-accounts-are-emptying-quickly">The holding accounts are emptying quickly</h2>
<p>That exchange checkpoint is becoming more urgent because the original holding accounts are emptying quickly. They held around 70 million XRP at 04:32 UTC on September 26. Roughly eight hours later, that balance was about 49 million XRP, according to CoinDesk’s review. In another visible detail, one account failed to send roughly 521,000 XRP because it did not have sufficient funds; a second account sent an identical amount to the intended recipient about an hour later.</p>
<p>That pattern supports the conclusion that the funds were being actively redistributed. It does not establish the reason for every transfer, whether a particular wallet belongs to a laundering service, or how much XRP has reached the market. Those require evidence beyond the ledger itself.</p>
<p>The decisive moment is not the next transfer between anonymous wallets. It is the first point at which a traceable XRP balance enters a service that knows who controls the account and can prevent it from leaving again.</p>
<p style="text-align: center;"><em>This article is provided for informational purposes only and does not constitute financial, investment or legal advice. On-chain balances, wallet labels and exchange actions can change quickly as the investigation continues.</em></p>
<p>The post <a href="https://coindoo.com/bitget-hacker-moves-millions-in-xrp-as-freezing-fails/" rel="noopener noreferrer nofollow">Bitget Hacker Moves Millions in XRP as Freezing Fails</a> appeared first on <a href="https://coindoo.com" rel="noopener noreferrer nofollow">Coindoo</a>.</p>

Bitget Hacker Moves Millions in XRP as Freezing Fails

Table of Contents

Coindoo.com

Other articles published on Sep 26, 2026

Join our free newsletter for daily crypto updates!