Bitget Attacker Moves $83 Million in XRP: Why Can’t the Company Freeze It?
About $83 million worth of XRP stolen in the Bitget attack has been moved to new addresses. Ripple has no authority to directly freeze these assets in the attacker’s wallet.
According to a CoinDesk review based on XRP Ledger records, approximately 103 million XRP taken in the attack was distributed from the initial receiving account to five wallets. As of 3:41 p.m. Turkey time on September 26, 54.16 million XRP had been sent from these wallets to other addresses in a total of 246 transfers. This amount represents approximately 53 percent of the stolen XRP.
The remaining balance of 48.82 million XRP in the original wallets was worth approximately $75 million at the price used in the report. Nearly all of this balance was held in three wallets; the other two wallets had only about 23 and 55 XRP, respectively.
Why Can’t Ripple Freeze the Stolen XRP?
Token issuers on the XRP Ledger can freeze the tokens they issue using appropriate controls. However, this authority does not extend to XRP, the network’s native asset. Under the network’s current rules, Ripple has no way to directly block the attacker’s XRP balance.
However, if stolen XRP reaches an exchange, the exchange can restrict the recipient’s account and prevent withdrawals. This is not the same as freezing XRP on the network, and it cannot be done while the assets remain in wallets controlled by the attacker.
Circle and Tether’s ability to freeze approximately $320,000 worth of USDC and USDT linked to the attack also illustrates this distinction: These stablecoins have controls that allow their issuing companies to block addresses.
Transfers Don’t Show That the XRP Was Sold
In CoinDesk’s review, the balance in the first five wallets fell from about 70 million XRP at 7:32 a.m. Turkey time on Saturday to 49 million XRP about eight hours later. However, these movements show that the funds were distributed to other wallets; they do not reveal how much was sold.
Bitget raised its estimate of the total attack losses to $387.5 million on Friday. The exchange said the difference stemmed from Zcash and TRON transfers that were not included in the initial calculation, and that there had been no new attack. The company says its protection fund covered the loss and customer balances were unaffected.
According to the announced schedule, Bitcoin withdrawals are set to resume on September 28, Ethereum withdrawals on September 29, USDT withdrawals on September 30, and withdrawals of other tokens on October 2.