A hacker responsible for stealing tens of millions of dollars worth of XRP from crypto exchange Bitget has begun shuffling roughly $83 million of the tokens into wallets that lie beyond the reach of Ripple's freeze mechanisms, according to on-chain tracking.
Funds on the Move
The attacker has nearly drained two of the wallets holding the stolen assets and is actively siphoning funds from a third, blockchain data shows. Around $75 million in XRP is still spread across the five original holding accounts, suggesting the laundering process remains ongoing.
The methodical movement of funds indicates the perpetrator is working to place the assets out of the reach of any intervention before they can be locked or clawed back.
Once the tokens land in wallets Ripple can't touch, recovery becomes vastly more difficult.
Why the Freeze Question Matters
Ripple, the company closely associated with the XRP Ledger, has the technical ability to freeze certain assets under specific conditions, a feature that can be used to halt the movement of illicitly obtained tokens. However, that power is limited, and once funds are moved into wallets outside those controls, the option to intervene largely disappears.
The incident highlights a recurring tension in crypto: the balance between decentralization and the ability to respond when large-scale thefts occur. For victims and exchanges, the window to act is often narrow.
- Two wallets have been almost fully emptied
- A third wallet is currently being drained
- About $75 million in XRP remains across the original five accounts
As the situation develops, investigators and blockchain analysts are likely to continue tracing the flow of funds in an effort to identify off-ramps or exchanges where the stolen XRP might eventually surface.