Bitget Hacker Moves $83 Million in Stolen XRP That Ripple Cannot Freeze — Updates TTO-2026-0925-166

Summary

The North Korea-linked hackers responsible for the $351.6 million Bitget exchange hack documented in TTO-2026-0925-166 have moved approximately $83 million in stolen XRP to new wallet addresses. Unlike USDC and USDT, which Circle and Tether were able to freeze following the hack, XRP cannot be frozen by Ripple or any third party — XRP’s ledger design does not include a centralized freeze mechanism for ordinary wallet addresses. The $83 million XRP movement represents the first large tranche of stolen assets to move successfully after the initial stablecoin freeze recovered approximately $36 million. The remaining stolen assets — estimated at approximately $232 million after stablecoin recovery and the XRP movement — are presumed in various stages of laundering.

Timeline

What Changed

TTO-2026-0925-166 documented the Bitget hack and the $36 million stablecoin recovery, with approximately $315 million presumed in active laundering. The $83 million XRP movement is the first confirmed successful movement of a large stolen asset tranche after the stablecoin freeze.

The XRP movement highlights a structural asymmetry in post-hack asset recovery. Centralized stablecoin issuers can freeze tokens in specific addresses — a capability used in multiple high-profile hacks. XRP, as a decentralized ledger asset, does not offer Ripple this capability. Ripple CEO Brad Garlinghouse confirmed publicly that Ripple has no mechanism to freeze or reverse the XRP transactions. The hackers’ sequencing — moving XRP after stablecoins were frozen — suggests awareness of which asset classes offer recovery optionality and which do not. Total confirmed unrecovered assets now stand at approximately $315 million minus the $83 million XRP moved, with laundering destination under active tracking by blockchain analytics firms.

Domain Intelligence

bitget.com — 61.92

Score unchanged from TTO-2026-0925-166. bitget.com scores in the low-trust range at 61.92. Bitget is the hacked exchange.