The Bitget hack has highlighted a key technical difference between XRP and issuer-controlled assets such as USDT and USDC. Although exchanges can restrict accounts receiving stolen cryptocurrency, Ripple cannot simply freeze native XRP while it remains in an attacker-controlled XRP Ledger wallet.
Bitget initially estimated that approximately USD 351.6 million was stolen in the September 24 breach. The figure was later increased to USD 387.5 million after additional affected assets on the Zcash and Tron networks were identified.
The attack affected assets across multiple blockchains, including ETH, XRP, USDT and USDC. Bitget said it identified and fixed the underlying vulnerability and began working with cybersecurity firms Mandiant and SlowMist on investigation and recovery efforts.
Nearly 103 million XRP was taken and initially divided among five accounts. By September 28, approximately USD 83 million worth of stolen XRP had moved from three holding wallets, while roughly USD 75 million remained in the original accounts.
The inability to freeze the stolen XRP is not because Ripple has chosen against intervention. It comes from the XRP Ledger’s architecture. XRP is the network’s native asset and does not have an issuer. The XRP Ledger’s official documentation states that its freeze functionality applies to issued tokens but not XRP itself.
Issued assets work differently. An organization issuing a token through XRPL can use mechanisms including Individual Freeze or Global Freeze to restrict its issued balances under certain circumstances.
As Ripple is not an issuer controlling native XRP balances, it cannot blacklist an attacker’s self-custodied address or instruct the XRP Ledger to reject otherwise valid XRP transfers.
Centralized stablecoins illustrate the distinction. Tether and Circle issue USDT and USDC and maintain mechanisms allowing certain addresses to be blacklisted. Following the Bitget breach, Circle and Tether froze approximately USD 320,000 in stablecoins connected with the incident. Those issuer-level controls cannot be applied to native XRP.
XRP being unfreezable at the protocol level does not mean investigators have no options. When stolen XRP reaches a centralized exchange, the exchange can identify the associated customer account, restrict withdrawals, and cooperate with investigators.
Blockchain analytics firms can also follow movements as XRP Ledger transactions remain publicly recorded. This makes the attacker’s destination important. Funds remaining in self-controlled XRP wallets cannot be frozen, but sending them into a compliant centralized service creates another potential intervention point.
Bitget has said customer balances remain unaffected and its protection resources will cover the loss. The exchange also began restoring withdrawals in stages following security checks.
Native XRP cannot be frozen by Ripple as XRP has no issuer with protocol-level freeze authority. Centralized exchanges can still restrict accounts receiving stolen funds. The Bitget hack shows why blockchain traceability does not automatically guarantee asset recovery.
Also Read: XRP Price Rally Tops 60% as Whales Target Major Breakout
1. Why can’t Ripple freeze stolen XRP?
XRP is the native asset of the XRP Ledger and does not have an issuer with freeze authority. Ripple therefore cannot blacklist self-custodied XRP or prevent otherwise valid transactions.
2. How much XRP was stolen in the Bitget hack?
Nearly 103 million XRP was taken and initially distributed across five accounts. By September 28, around USD 83 million worth of stolen XRP had moved from three holding wallets.
3. Why can USDT and USDC be frozen but XRP cannot?
USDT and USDC are issued by Tether and Circle, which maintain mechanisms for blacklisting certain addresses. Native XRP has no equivalent issuer capable of activating such controls.
4. Can exchanges freeze XRP stolen by hackers?
Yes, centralized exchanges can restrict accounts when stolen XRP reaches their platforms. They can suspend withdrawals and cooperate with investigators, even though XRP itself cannot be frozen at the protocol level.
5. Can stolen XRP still be tracked on the blockchain?
Yes. XRP Ledger transactions are publicly recorded, allowing blockchain analytics firms and investigators to trace movements between addresses, although tracking the funds does not automatically mean they can be recovered.