Stolen Bitget XRP keeps moving because nobody can freeze XRP itself
Victoria Shinder2 min readRoughly 54 million of the nearly 103 million XRP stolen from the exchange Bitget on Thursday had left the attacker's original five holding wallets by 12:41 UTC on Saturday, according to CoinDesk's review of XRP Ledger records (https://www.coindesk.com/markets/2026/09/26/bitget-hacker-moves-usd83-million-in-stolen-xrp-that-ripple-cannot-freeze). Two of the wallets, which each started with 20 million XRP, were almost empty; a third was down to about 5.8 million. Circle and Tether have frozen about $320,000 of stablecoins linked to the breach, and Bitget says its protection fund covers the loss, with withdrawals resuming in stages from 28 September to 2 October.
The reason the XRP keeps moving is a rule of the ledger, not a choice by anyone involved. The XRP Ledger's own documentation is explicit: issuers can freeze the tokens they issue, but this does not apply to XRP, the ledger's native asset, and no one can freeze XRP. Freezes exist for trust-line tokens - individual, deep and global freezes set by the issuer - and multi-purpose tokens have a similar feature called locking. The documentation adds the practical exception that matters here: custodial exchanges can always freeze funds they hold at their own discretion.
That is why the stablecoin portion could be stopped and the XRP could not. USDC and USDT are issued tokens whose issuers keep blacklisting controls; XRP has no issuer that could exercise such a control.
What it means
For recovery, the consequence is that the only choke points for native XRP are the places it has to pass through to become useful - exchanges and other custodians that can restrict an account once stolen funds arrive. Tracing therefore matters more than freezing: the attacker's movements are public on the ledger, and the practical question is whether receiving venues act on them in time.
For anyone designing on the XRP Ledger, the episode is a reminder of what the freeze feature is and is not. It is a compliance tool for issued assets, and it can be permanently renounced by an issuer through the No Freeze setting. It is not a security control over XRP itself, and custody decisions for XRP should assume that a theft cannot be reversed at the ledger level.