The cyber-attack on cryptocurrency exchange Bitget resulted in the loss of roughly $388 million in digital assets, according to the platform’s latest accounting. Of the 103 million XRP taken, the attacker has already moved about $83 million out of three primary holding wallets. The remaining $75 million sits in accounts that, under the current XRP Ledger rules, cannot be frozen.
XRP ledger limitations and recovery options
XRP is the native token of the XRP Ledger, a blockchain operated by payments firm Ripple. While Ripple can freeze tokens it issues on the ledger, that authority does not extend to XRP itself. Consequently, Ripple cannot directly block the attacker from spending the stolen coins.
Recovery now depends on the behavior of downstream exchanges. If a platform receives the compromised XRP, it can restrict the recipient’s account and halt withdrawals, but it cannot seize the coins while they remain under the attacker’s control. Stable-coin issuers have taken a different approach: Circle and Tether have each blacklisted addresses linked to the breach, freezing about $320,000 worth of USDC and USDT respectively.
Market impact and Bitget’s response
The rapid outflow of XRP accelerated overnight. Early Saturday morning, roughly 70 million tokens were still in the original five accounts; eight hours later that number fell to about 49 million. By the time of reporting, roughly 54 million XRP had left the initial wallets and been redistributed to additional addresses, though the exact destinations and any subsequent sales remain unclear.
At the time of the movement, XRP was trading near $1.54, down about 4% over the previous 24 hours but still holding a weekly gain of roughly 9%. The original haul, valued at about $160 million, represents roughly 4% of the token’s average daily trading volume of $4.4 billion. The extent to which a forced sale could affect price will depend on available liquidity at the time of execution.
Bitget has confirmed that its protection fund will fully cover the loss, ensuring that customer balances are not affected. The exchange plans to restart Bitcoin withdrawals on September 28, followed by Ether on September 29, USDT on September 30, and other assets on October 2.
Why it matters
The incident highlights a structural vulnerability in the XRP Ledger: the inability of Ripple to freeze its native token leaves large-scale thefts difficult to contain. It also underscores the growing reliance on exchange-level safeguards and stable-coin blacklisting as secondary lines of defense. For investors, the breach serves as a reminder that even high-profile platforms can be exposed to significant operational risk, while the broader market watches how such events influence token liquidity and price stability.
