Hackers walked away from Bitget with $351.6 million, and a massive chunk of it sits beyond the reach of any organization that might try to stop them. Whether XRP holders feel the fallout depends on a decision the attackers have…
This post may contain links from our sponsors and affiliates, and Flywheel Publishing may receive compensation for actions taken through them.
Recently, a major security breach at the crypto exchange Bitget resulted in the theft of $351.6 million, with XRP (CRYPTO:XRP) accounting for the largest portion—about 103 million XRP worth roughly $157 million at that time. Unlike the dollar tokens taken during the hack, that XRP cannot be frozen by any organization.
Despite this, XRP’s trading price rose to $1.55 on September 25, showing a 4% increase. But does this unfreezable XRP link to the Bitget hack pose a risk to XRP holders?
Attackers Faked Transfer Orders Instead of Stealing Bitget’s Keys
Bitget CEO Gracy Chen revealed that attackers exploited a vulnerability in the exchange’s backend system. They sent fake transaction data that tricked Bitget’s approval process into approving 19 unauthorized withdrawals from its “hot” and “warm” wallets—online wallets used for daily transactions.
Importantly, the attackers did not gain access to Bitget’s private keys —the vital codes needed to authorize transfers —and the exchange’s cold wallets, used for long-term storage, remained safe. Bitget’s systems detected the initial unauthorized transfer at 18:31 UTC, prompting an immediate halt to further withdrawals as security firms Mandiant and SlowMist investigated. While withdrawals were paused, users could still deposit and trade.
Chen also indicated that some of the attack’s IP addresses matched those used by a North Korean hacking group in the past, but Bitget has not definitively attributed the hack to any party. This incident marked the second significant nine-figure crypto theft in September, following a $320 million hack of Liquid Network on September 6.
XRP Made Up About 44% of the $351.6 Million Taken
Of the $351.6 million taken, about 44% was XRP—about $157 million. An on-chain tracker, Lookonchain, noted that in addition to XRP, attackers also stole roughly 31,900 Ethereum (CRYPTO:ETH), valued at about $86 million, and about $75 million in stablecoins like USDT and USDC. They also took 3,000 XAUt (the tokenized gold) worth about $13 million, along with smaller amounts of BNB, Avalanche, and Tron.
The XRP was quickly moved to a new address and dispersed into five wallets. Four of these wallets held around 20 million XRP each, while a fifth held about 23 million XRP. Many of these transactions included tiny payments of 0.00001 XRP—typically a tactic scammers use to confuse targets with lookalike addresses.
About Three-Quarters of the Stolen Assets Cannot Be Frozen
XRP operates on a distinct ledger where freeze tools only affect issued tokens—coins created by a company—meaning XRP itself, as the ledger’s native coin, cannot be frozen by Ripple, the XRP Ledger Foundation, or any other entity. Exchanges can freeze assets held in their accounts, but not XRP in the wild.
While XRP is the largest unfreezable asset involved in this hack, it’s not the only one. Other native coins like ETH, BNB, Avalanche, and Tron also can’t be frozen. Together, they account for about $269 million of the stolen amount—making up three-quarters of the total theft. In contrast, the dollar tokens and gold, valued at around $88 million, their issuers can freeze.
The attackers moved quickly, converting about $170 million of the stolen assets into ETH during the heist, effectively distancing themselves from potential freezes. However, they still face the challenge of exchanging the XRP for cash, which involves going through exchanges and swap services—platforms where transactions can still be stopped.
So far, around 400,000 XRP, worth about $620,000, has moved from one wallet, with an additional 33,500 XRP spotted passing through the Bridger’s swap service.
Does the Unfreezable XRP From the Bitget Hack Put XRP Holders at Risk?
The potential risk to XRP holders is relatively minor. The stolen XRP, valued at about $160 million at $1.55, represents only about 3.8% of the $4.2 billion in XRP that traded in the 24 hours leading up to September 25. Additionally, XRP exchange-traded funds (ETFs) alone received $38 million in inflows on September 22 and 23.
Bitget customers also have some security; CEO Chen said the exchange’s User Protection Fund, holding 5,500 BTC worth over $464 million, will cover the full loss.
However, the timing of any sales by the attacker is critical. If they sell large amounts of XRP in a single day, it could impact the market more than if they spread sales out over time. If withdrawals from Bitget reopen shortly and thieves leave the XRP in the wallet, the hack may primarily be a loss for Bitget rather than for XRP holders.
Contact [email protected] for any questions or corrections.