About 54 million XRP, valued near $83 million, had left the five original Bitget attacker accounts by September 26, shifting the recovery effort toward custodial gateways.
Key Takeaways
- About 54 million XRP left five attacker wallets.
- Ripple cannot freeze native XRP balances.
- Roughly 49 million XRP remains in the original accounts.
- Exchanges are the crucial recovery checkpoint.
The stolen XRP is no longer sitting where it first landed. A CoinDesk review of XRP Ledger records found that roughly 54 million XRP had left the five original accounts used to hold the Bitget haul by 12:41 UTC on September 26. Two accounts that began with 20 million XRP each had been reduced to about 23 and 55 XRP, while a third held roughly 5.8 million XRP.
About 49 million XRP, valued near $75 million at the time, remained in those first five accounts. That figure only counts the original holding accounts: funds that leave them can still be under the attacker’s control in newly created wallets. The on-chain question is whether the XRP reaches a service that can identify and stop the person controlling it.
To understand what the $83 million figure actually measures, it helps to separate the original theft from the later redistribution.
The five original wallets show only the first stage
Public blockchain records show that roughly 103 million XRP left two Bitget-linked XRPL accounts on September 24 and reached the address rwNhefsz1UQEusxhCvHip3RANinWi4CTck. Arkham has placed that address in its Bitget Hacker entity.
The amount was then split among five holding accounts. The split confirms where the XRP first went. It cannot, by itself, show whether each later address belongs to the same operator, a laundering intermediary or an exchange customer.
Roughly 103 million XRP was transferred from Bitget-linked wallets into the attacker cluster.
The latest visible movement
About 54 million XRP had left the first five holding accounts by September 26.
The public ledger cannot establish how much XRP has been sold or identify every beneficial owner behind the new accounts.
Calling every transfer a “cash-out” would overstate the evidence. A movement between attacker-controlled wallets does not create new selling pressure by itself. Selling becomes a more concrete risk when the route reaches a centralized exchange, OTC desk, instant-swap service or another gateway that can turn XRP into a different asset or fiat money.
Ripple cannot freeze a native XRP balance
The limitation is built into how the XRP Ledger treats its native asset. XRP is not an issued token and has no issuer that can blacklist an account. The XRPL documentation states that freeze features apply to issued tokens held through trust lines, not XRP itself.
Ripple, the XRPL Foundation and validators therefore have no built-in authority to mark these native-XRP accounts as frozen. A normal payment from an account that holds sufficient XRP remains valid under the ledger’s current rules.
Traceability is not control. The XRP Ledger makes the transfers public, yet that transparency does not give Ripple authority to seize or lock native XRP held in another account.
The contrast is visible in the stablecoin portion of the same breach. CoinDesk reported that Circle and Tether had frozen about $320,000 in USDC and USDT tied to the incident. Those assets include issuer-level blacklist controls. Native XRP does not.
The important intervention point is the exchange deposit
Once the XRP reaches an exchange-controlled address, the issue changes from protocol rules to custodial control. The exchange can connect a tagged XRP deposit to a customer account, stop withdrawals or trading, preserve records and respond to investigators.
This distinction is especially relevant on the XRP Ledger because large exchanges commonly use shared deposit wallets. A destination tag tells the exchange which internal customer account should receive a payment. The tag is not public proof of a person’s identity, but it creates a point where the platform can match an on-chain deposit with its own customer records.
A September 25 public-XRPL analysis traced one route from an original holding account through intermediary addresses toward Binance and MEXC deposit infrastructure. That does not prove those exchanges received or credited all later transfers, and neither platform should be described as having frozen funds without a public confirmation. It does show why on-chain alerts matter before a large balance reaches an exit.
The holding accounts are emptying quickly
That exchange checkpoint is becoming more urgent because the original holding accounts are emptying quickly. They held around 70 million XRP at 04:32 UTC on September 26. Roughly eight hours later, that balance was about 49 million XRP, according to CoinDesk’s review. In another visible detail, one account failed to send roughly 521,000 XRP because it did not have sufficient funds; a second account sent an identical amount to the intended recipient about an hour later.
That pattern supports the conclusion that the funds were being actively redistributed. It does not establish the reason for every transfer, whether a particular wallet belongs to a laundering service, or how much XRP has reached the market. Those require evidence beyond the ledger itself.
The decisive moment is not the next transfer between anonymous wallets. It is the first point at which a traceable XRP balance enters a service that knows who controls the account and can prevent it from leaving again.
This article is provided for informational purposes only and does not constitute financial, investment or legal advice. On-chain balances, wallet labels and exchange actions can change quickly as the investigation continues.
Kosta has reported on cryptocurrency markets and blockchain infrastructure since 2020, bringing over six years of hands-on experience in the crypto industry built through daily tracking of markets, trends, and emerging blockchain developments. Specializing in Bitcoin on-chain analysis, institutional ETF flows, and digital asset price action, his work at Coindoo has been cited by other news agencies and consistently covers market developments with a focus on data-driven reporting across Bitcoin, Ethereum, Solana, and XRP.
Over the years, Kosta has contributed to multiple crypto media outlets in different regions, authoring over 6,000 articles across the sector. His reporting spans cryptocurrency markets and the broader fintech industry, tracking not only price action but also the technological and regulatory forces shaping the ecosystem.
To support his analysis, Kosta actively leverages on-chain data and metrics from leading platforms such as Santiment, Glassnode, and CryptoQuant, enabling deeper, evidence-based market insights. He believes in the power of transparency and the data that underpins the blockchain ecosystem.
His academic background in Marketing Management from Denmark further complements his analytical approach, adding a strong understanding of communication strategy and content positioning to his work.
Be the first to comment