Bitget Hacker Transfers $83 Million in Stolen XRP Beyond Ripple’s Reach

A hacker linked to the theft of XRP from cryptocurrency exchange Bitget has moved approximately $83 million in digital assets, leaving investigators with limited options for recovering the funds. Two of the wallets associated with the original transfers have been almost emptied, while a third is still being drained, according to the available transaction information.

Roughly $75 million remains distributed across the five accounts that initially held the stolen XRP. The movement of the assets indicates that the person or group controlling the wallets is actively attempting to disperse the funds, a common tactic in cryptocurrency theft cases designed to make tracing and recovery more difficult.

The transfers also highlight a central feature of the XRP Ledger: confirmed transactions generally cannot be reversed by a central administrator. Once XRP has been sent from one wallet to another and recorded on the network, the original owner cannot simply cancel the transaction. Ripple, the company associated with the XRP ecosystem, does not possess a universal mechanism to retrieve or freeze coins held in privately controlled wallets.

That distinction is important in cases involving stolen cryptocurrency. Although Ripple developed and supports technology connected to the XRP Ledger, it does not operate the network as a conventional bank would manage a payment system. XRP transactions are validated by a distributed network of participants, and ownership is controlled through cryptographic keys. Whoever holds the private keys to a wallet can generally authorize transfers from it.

The inability to freeze the assets does not mean the transactions are impossible to follow. Public blockchain records allow anyone to examine the movement of XRP between addresses. Investigators, exchanges and blockchain-analysis firms can monitor the wallets, identify intermediary accounts and look for points where the tokens may be converted into other assets or transferred to a trading platform.

Those monitoring efforts can be particularly useful when stolen coins reach a centralized exchange. Such platforms commonly require customers to create accounts and, depending on the jurisdiction and the service, may collect identifying information under know-your-customer and anti-money-laundering rules. If an exchange can connect incoming funds to a reported theft, it may be able to restrict the account or cooperate with law-enforcement requests. That possibility often leads attackers to split funds across multiple wallets before attempting to cash out.

The latest transfers suggest that the stolen XRP is not sitting untouched in a single address. Two of the five original holding wallets have been nearly depleted, and another is continuing to lose funds. With around $75 million still in the original accounts, a substantial portion of the assets remains visible on the ledger, even as the wallet activity complicates efforts to track the full balance.

The difference between tracing and recovering funds is critical. Blockchain records may show where the XRP has gone, but they do not automatically reveal the identity of the person controlling a wallet. Nor can a visible transaction be undone merely because it has been linked to a theft. Recovery typically depends on intercepting the assets before they are exchanged, persuading a service provider to block them, or obtaining legal and investigative assistance to identify the individuals involved.

The case also demonstrates the risks exchanges face when large balances are concentrated in a limited number of wallets. A compromise of access credentials, signing systems or internal controls can allow attackers to move substantial amounts quickly. Once the transfers begin, the public nature of the blockchain enables rapid scrutiny, but it also gives the attacker an immediate route for shifting the funds among addresses.

For Bitget, the movement of the XRP adds urgency to efforts to establish exactly how the theft occurred and whether any of the assets can be frozen after entering third-party services. For the broader crypto market, it is another reminder that transparency on a blockchain does not equal reversibility. Every transaction may be permanently recorded, yet the record alone cannot guarantee that stolen funds will be returned.

The remaining XRP continues to be the most direct focus for monitoring. As long as it stays in identifiable wallets, investigators can observe attempts to transfer it. But with no general-purpose freeze button available through Ripple or the XRP Ledger, the outcome will depend on whether the assets are intercepted at a later stage rather than reversed on the network itself.