Hackers Move Over Half of Stolen XRP, XRPL’s Lack of Freeze Functionality Leaves Ripple Powerless
Hackers involved in the Bitget exchange breach have significantly moved over half of the 103 million XRP tokens, valued at approximately $83 million, that were initially stolen. The XRP Ledger (XRPL), however, does not support a freeze function, leaving payment company Ripple unable to intervene.
According to on-chain records from the XRP Ledger, approximately 54 million XRP, worth around $83 million, has been transferred out of five initial wallets controlled by the hackers. This represents more than half of the stolen XRP, with less than half of the compromised assets remaining accessible.
Unlike stablecoins such as Circle’s USDC and Tether’s USDT, which can be frozen on their respective blockchains by blacklisting addresses, XRP, the native currency of the XRP Ledger, lacks this inherent freeze capability. While Ripple issues its own tokens on the chain, it does not possess control over transactions involving native XRP.
This technical limitation means that as long as the XRP remains within wallets controlled by the hackers, there is no mechanism to prevent its movement or sale. Recovery efforts are contingent on the hackers transferring the XRP to an exchange that does support freeze functionality, allowing that exchange to restrict the account and block withdrawals.
The pace of the hackers’ transfers notably accelerated on Saturday. At 04:32 UTC, the five wallets held approximately 70 million XRP. Eight hours later, this figure had dwindled to just 49 million XRP. The hackers have been observed distributing the funds across a larger number of wallets, with some transfers following routes previously utilized by the initial wallet.
One attempted transfer of approximately 521,000 XRP failed due to insufficient balance in the originating account. Roughly an hour later, a second wallet sent the same amount to the same recipient, suggesting a deliberate fund allocation strategy rather than random activity.
XRP was trading around $1.54 on Saturday, marking a roughly 4% decline over the preceding 24 hours, though it maintained a 9% gain for the week. At this price, the initially stolen 103 million XRP was valued at approximately $160 million, representing about 4% of XRP’s daily trading volume of around $4.4 billion.
The actual impact on XRP’s price from a large-scale sell-off would depend on market depth. However, current transfer patterns suggest the hackers are prioritizing diversification and holding rather than immediate liquidation, potentially to avoid triggering significant market volatility associated with large sell orders.
Bitget revised its total stolen amount to $387.5 million on Friday, an increase from the initial estimate of $350 million, to include assets stolen from the Zcash and TRON chains. The exchange confirmed these were all part of the same attack and not new incidents.
Bitget reiterated that its protection fund will fully cover the losses, ensuring user funds remain unaffected. The planned phased resumption of withdrawals is as follows: Bitcoin on September 28, Ethereum on September 29, USDT on September 30, and other cryptocurrencies on October 2.
