Key Takeaways
- About 54 million XRP, worth roughly $83 million, has moved out of the five wallets that initially held the stolen XRP.
- Tether and Circle could freeze stablecoins linked to the breach because USDT and USDC have issuer-controlled blacklist mechanisms.
- Ripple cannot do the same with XRP because XRP is the native asset of the XRP Ledger, not a token issued by Ripple.
More than half of the XRP stolen in the $387.5 million Bitget hack has already been moved, but the bigger story is what nobody could do about it.
Nearly 103 million XRP was taken during the Sept. 24 breach and initially divided among five accounts. By Sept. 26, around 54 million XRP, then worth approximately $83 million, had left those original wallets. Roughly 49 million XRP, valued near $75 million, remained.
That does not necessarily mean the hacker sold $83 million of XRP. The onchain movements show the funds being redistributed to other addresses, but transfers between wallets alone cannot establish whether the assets were liquidated.
Bitget has confirmed that approximately $387.5 million in assets were transferred to attacker-controlled addresses, raising its initial estimate of $351.6 million after accounting for additional Zcash and TRON assets.
Why Could Tether Freeze USDT but Ripple Couldn’t Freeze XRP?
The difference comes down to who controls the asset.
USDT is issued by Tether, which can blacklist addresses and prevent frozen tokens from moving. Circle has similar controls over USDC. Following the Bitget breach, the two issuers froze about $320,000 in stablecoins linked to the attack.
XRP works differently. As the native asset of the XRP Ledger, it is not issued by Ripple and cannot be remotely frozen by the company. Although the XRP Ledger supports freezing for issued tokens, those controls do not extend to XRP itself.
That means that even when Ripple, Bitget, and investigators identify wallets holding stolen XRP, Ripple cannot blacklist those addresses or freeze their balances.
Attention has therefore shifted toward the infrastructure attackers use to move the funds. Bitget CEO Gracy Chen called on THORChain to refuse transactions involving addresses linked to the attacker.
“Decentralization is a design principle, not a shield for facilitating known stolen funds,” Chen said.
GoPlus Security went further by disputing THORChain’s comparison to base-layer networks such as Bitcoin and Ethereum. It argued that THORChain nodes actively sign outbound transactions through TSS vaults and that the protocol already has mechanisms to pause trading or outbound signing.
“THORChain has never been strictly decentralized,” GoPlus said.
The security firm also pointed to THORChain’s previous use of emergency halts, arguing that intervention is technically possible when funds are considered at risk.
The criticism highlights an important distinction in the Bitget recovery effort: Ripple may lack the technical ability to freeze native XRP, but critics argue that protocols processing the stolen assets can still face a separate decision over whether to facilitate their movement.
Where Can the XRP Actually Be Stopped?
The crucial point comes when stolen XRP reaches a centralized intermediary.
An exchange receiving flagged XRP can potentially identify the associated customer account, restrict trading or withdrawals and cooperate with investigators.
But while the XRP remains in self-custodied wallets, there is no issuer-level switch equivalent to Tether’s blacklist.
That makes the Bitget hack an unusually clear demonstration of the trade-off.
Stablecoin issuers can intervene when assets are stolen, but that same power means an identifiable company ultimately retains control over whether certain tokens can move. Native XRP removes that issuer-level control — even when the person moving it is an alleged hacker.
fo
Top Trending Crypto Articles
The information provided in this article is for informational purposes only. It is not intended to be, nor should it be construed as, financial advice. We do not make any warranties regarding the completeness, reliability, or accuracy of this information. All investments involve risk, and past performance does not guarantee future results. We recommend consulting a financial advisor before making any investment decisions.
Dr. Guneet Kaur is a senior editor at CCN.com and a Science Fellow at Exponential Science. She is a fintech and blockchain expert with extensive experience in digital finance education, blockchain ecosystems, and cryptocurrency markets. She has worked with global media such as Cointelegraph, as well as education and blockchain platforms, to design and lead strategic content and learning initiatives. As an educator and assessor for top-tier executive programs, she bridges real-world fintech trends with academic insight.
Dr. Kaur is also a published researcher and peer reviewer across fintech and data science journals, including Financial Innovation Journal and International Journal of Big Data Intelligence and Applications. Her work spans data-driven analysis, Web3 innovation, and technical content development. With a strong foundation in both industry and academia, she translates complex financial technologies into practical applications, empowering learners, professionals, and institutions across the rapidly evolving digital finance landscape.
