Bitget hacker moves $83M in stolen XRP that Ripple can't freeze

The Bitget hacker has already moved $83 million in stolen XRP, and Ripple, the company behind the cryptocurrency, cannot freeze those funds. The news, reported by CoinDesk, confirms one of the largest XRP thefts in recent years and exposes a structural problem: on a decentralized blockchain, no one has the key to reverse a transaction. If you thought Ripple could step in, you're wrong.

Context: What you weren't told about the Bitget hack

Bitget, one of the world's largest exchanges, suffered a hack days ago that compromised its hot wallets holding XRP. Unlike other thefts where stablecoins can be frozen by centralized issuers like Tether or Circle, here the asset is XRP, a native coin on a blockchain with no pause button. Ripple controls a large portion of the supply in escrow, but it has no power to reverse transactions or freeze individual addresses. That's the key difference between an asset with a centralized issuer and one that's truly decentralized.

Details: Two wallets emptied, a third being drained

According to on-chain data, the attacker has been moving funds through multiple addresses to make tracing harder. The report indicates that two wallets are already almost empty and a third is being drained right now. Of the five original wallets that received the loot, roughly $75 million in XRP remains unmoved. The hacker hasn't used a mixer (like Tornado Cash) because XRP doesn't natively support one, but they are fragmenting transfers into small amounts to avoid automated alerts from exchanges. So far, no major exchange has announced freezing deposited funds, suggesting the attacker might be using platforms with lax controls or even DEXs without KYC.

Analysis: Who wins and who loses here?

The hacker wins, at least for now, because they can move funds unimpeded. Bitget loses—it will have to cover the losses (if it chooses to) or face a confidence crisis—and users lose, once again seeing that a centralized exchange is no guarantee of security. Ripple also loses in reputational terms: many believe the company has near-absolute control over XRP, and this case proves otherwise. From my perspective, this should push the industry to stop selling the idea that cryptocurrencies can be "safe" without acknowledging custody risks. Decentralization has a price: no one saves you if you get robbed.

Implications: What happens to the stolen XRP and Bitget?

The hacker will likely try to convert XRP into other assets or fiat through no-KYC exchanges or P2P markets. Exchanges with strong compliance (Binance, Coinbase, Kraken) could freeze funds if they detect suspicious deposits, but that only works if the hacker makes a mistake. Meanwhile, Bitget will need to beef up its security and probably compensate affected users, which could cost millions. On the regulatory front, this case strengthens the argument for more control over exchanges, but also for those who defend self-custody as the only real way to protect your assets. The paradox: the same decentralization that protects users from censorship is what prevents recovering stolen funds.

The Bitget hacker keeps moving $83 million in stolen XRP, and no one can stop them. How long will we keep trusting third parties that promise security they can't guarantee?

Source: CoinDesk