The attacker behind the Bitget security breach has moved a significant portion of the stolen XRP holdings, while recovery efforts face limitations due to the structure of the XRP Ledger.
Following the breach, approximately 103 million XRP taken from Bitget was distributed across five wallets. Blockchain tracking shows that several of these wallets have since transferred large amounts of the stolen assets to new addresses.
According to transaction records reviewed by CoinDesk, two wallets that initially held around 20 million XRP each were reduced to only small remaining balances, while another wallet also transferred out a significant portion of its holdings.
The movement of the stolen XRP highlights a key difference between XRP and issued tokens on the XRP Ledger. While the network supports freezing mechanisms for certain issued assets, XRP itself does not include a built-in freeze function. As a result, Ripple cannot directly freeze or block the attacker’s XRP holdings.
Recovery efforts therefore depend largely on where the stolen assets move next. Cryptocurrency exchanges receiving the stolen XRP may restrict associated accounts and prevent withdrawals, but XRP held inside attacker-controlled wallets cannot be frozen through the network’s existing rules.
Meanwhile, stablecoin issuers have taken action on assets connected to the breach. Circle and Tether have frozen a portion of USDC and USDT linked to the attack because those tokens include address-control mechanisms that allow issuers to blacklist specific wallets.
Blockchain data shows that XRP transfers accelerated during the weekend, with tens of millions of tokens leaving the original holding addresses. The transactions indicate that the attacker is distributing the stolen funds across additional wallets, although they do not confirm how much XRP has been sold on the market.
Some transfers followed similar patterns to previous movements, including repeated payment attempts and transfers between newly created addresses.
XRP was trading near $1.54, with the asset experiencing short-term price pressure while maintaining weekly gains. The original stolen XRP amount represented a significant value relative to the asset’s daily trading activity, although the potential market impact of any sale would depend on available liquidity and buyer demand.
The Bitget incident continues to highlight challenges surrounding crypto security, asset recovery, and the differences between blockchain networks that support asset controls and decentralized assets that cannot be directly frozen.
