- Around $83m (roughly £62m) of the XRP taken from Bitget has been moved out of the wallets holding it, according to CoinDesk.
- Two of those wallets are close to empty and a third is being drained. About $75m remains across the five original accounts.
- Ripple cannot freeze native XRP the way Circle and Tether froze after the same breach.
The money taken from Bitget is moving again. About $83m of XRP has left the wallets it had been sitting in, and Ripple, the company most closely associated with XRP, has no ability to stop it. That second part surprises a lot of holders.
Whether stolen crypto can be frozen has less to do with the exchange it was taken from than with which coin was taken. Stablecoins have an off switch that the issuer controls. XRP, bitcoin and ether do not have one.
If your money sits on an exchange, that distinction quietly decides how much of it is recoverable on the worst day, and no exchange’s security page mentions it.
What has moved
CoinDesk reports that two of the wallets holding the stolen XRP have been almost emptied and a third is being drained, with roughly $75m still spread across the five original accounts. The movement itself doesn’t mean the coins have been sold. Funds get shuffled between addresses for all sorts of reasons, including to make tracing harder.
A note on sourcing, because it matters here. We could not find a primary source for these figures: no statement from Bitget, none from Ripple, and no published analysis we could check directly. The numbers come from CoinDesk’s reporting, and in a live incident figures are revised often. The $351.6m first reported as leaving Bitget’s hot wallets was later counted at $387.5m, which we covered in our earlier pieces on the breach.
Why Circle could freeze and Ripple can’t
Circle and Tether froze $318,000 of the money taken from Bitget. It was a small fraction of the total, but it was possible at all because of how their are built.
USDC and USDT are tokens issued by a company on top of someone else’s . The issuer writes the rules of the token, and both companies wrote in a blacklist function: a switch that lets them mark an address so its balance can no longer be moved. They use it when law enforcement asks, and sometimes on their own initiative. The coins aren’t returned, they’re just frozen in place.
XRP works differently. It’s the native asset of the XRP Ledger, in the same way ether is native to Ethereum. Ripple was involved in creating both the ledger and the supply of XRP, and it still holds a large amount of it, but holding a lot of something is not the same as controlling everyone else’s. There is no address on the network that can reach into another wallet and stop a transaction.
The confusing bit is that the XRP Ledger does have a freeze feature. It applies to tokens issued on the ledger by a gateway, where an identifiable issuer stands behind the balance, and not to native XRP. Ripple could freeze balances of RLUSD, the stablecoin it issues, for exactly the same reason Circle can freeze USDC. It cannot do it to XRP.
That leaves one realistic choke point, and it isn’t the ledger. It’s the exit. Stolen coins usually have to pass through an exchange to become spendable money, and exchanges can refuse the deposit or freeze the account. That depends on individual companies choosing to act, and it works better on assets and routes that are heavily monitored.
What it means for money held on an exchange
For a UK reader the practical point is unglamorous. There is no FSCS protection on crypto held with an exchange. If the exchange is breached, you are relying on two things: whether the company chooses to make customers whole from its own funds, and whether any of the stolen assets can be stopped by someone.
The second of those varies by coin, and most people never think about it until it matters. A balance held in stablecoins has a small chance of being frozen mid-flight. A balance in XRP, bitcoin or ether does not, on the network itself. None of that is a reason to hold one thing rather than another, and it isn’t advice to move anything. It’s context that is missing from almost every announcement made after a hack.
Our guide to self-custody covers what holding your own keys does and doesn’t protect you from, and our guide to withdrawals explains what normally happens when an exchange suspends them.
What to watch
Whether the remaining $75m follows the same path. Our inference, clearly labelled as inference: coins being consolidated out of holding wallets usually means a cash-out attempt is being prepared, though that is a pattern rather than a certainty.
Beyond that, whether any exchange publicly freezes deposits linked to these addresses, and whether Bitget publishes a full account of what was lost and what customers will get back. So far it has said very little on the record, and that silence is doing its own damage to people waiting for an answer.