# Bitget Hack: Stolen XRP Cannot Be Frozen, but USDT Can

**By Hasan Şentürk** · Published September 28, 2026



Bitget has scheduled the return of customer withdrawals in four stages, beginning with Bitcoin on September 28, days after an intrusion the exchange now values at $387.5 million. Ether is set for September 29, USDT for September 30, and the remaining tokens for October 2.

The withdrawal queue is only the visible half of the damage. Nearly 103 million XRP taken in the same attack has been moving through wallets the attacker controls, and about $75 million of it now sits where no company, court, or exchange can freeze it. That gap is not a failure by anyone's security team. It is how the XRP Ledger was built, and the same limit applies to most coins that retail investors keep on a platform.

## The Withdrawal Queue Opens in Four Stages

Bitget paused withdrawals within hours of detecting the transfers on September 24 and kept deposits and trading running. The schedule it published puts the restart in four steps.

| Stage | Date | Assets |
|---|---|---|
| 1 | September 28 | Bitcoin (BTC) |
| 2 | September 29 | Ether (ETH) |
| 3 | September 30 | Tether (USDT) |
| 4 | October 2 | Remaining tokens |

Staging a restart is standard after a platform loses control of its hot wallets, because each asset group sits behind its own wallet structure, liquidity lines, and counterparties. The exchange's first notice, published on September 24, describes the intrusion as limited to parts of the hot and warm layers, with cold storage untouched, and says account balances stayed accurate ([Bitget security notice](https://www.bitget.com/support/articles/12560603896024)).

## Reading the Trail of 103 Million XRP

Close to 103 million XRP left the exchange on September 24 and was divided among five accounts. Ledger records show how quickly the coins spread out. By 12:41 UTC on Saturday, September 26, two accounts that had started with 20 million XRP each were down to about 23 tokens and about 55 tokens, while a third had fallen to roughly 5.8 million. About 54 million XRP had left the original accounts, and roughly $83 million had been moved, according to [CoinDesk's reporting](https://www.coindesk.com/markets/2026/09/26/bitget-hacker-moves-usd83-million-in-stolen-xrp-that-ripple-cannot-freeze) on transactions visible on the public ledger.

Two details in that record matter more than the totals. The withdrawals accelerated overnight, with the balance across the five original accounts dropping from about 70 million XRP to 49 million in roughly eight hours. And the transfers spread coins across fresh addresses without showing whether any of it was sold. Distribution is the step that makes tracing harder, and it usually comes before an attempt to convert stolen tokens into something a bank will accept.

Size is a separate question from speed. XRP traded near $1.54 on Saturday, about 4% lower over 24 hours and still roughly 9% higher on the week, according to CoinGecko data cited by CoinDesk. At that price the original XRP haul was worth about $160 million, close to 4% of the token's reported $4.4 billion in daily trading volume. A haul of that size can be absorbed by normal market flow, which is one reason the price barely moved.

## Why XRP Has No Freeze Switch

The XRP Ledger can freeze tokens that companies issue on top of it. It cannot freeze XRP itself. XRP is the network's native asset, so there is no issuer to instruct and no administrative key that reaches into a private wallet. Ripple, the payments company most closely tied to the network, cannot block the attacker from spending those coins.

That one difference decides what recovery looks like, and it separates crypto assets into three groups.

- **Native coins.** Bitcoin, ether, XRP, and similar assets run on their own networks with no issuer behind them. Once they leave a custodian's wallet, blocking them depends on cooperation from wherever they are deposited next.
- **Issuer tokens.** USDT, USDC, and most stablecoins are entries created by a company, and that company keeps blacklist controls aimed at specific addresses.
- **Exchange accounts.** A platform that receives stolen coins can restrict the receiving account and prevent withdrawals. It cannot pull coins out of a wallet the attacker controls.

## The Recovery Powers That Do Exist

Issuer controls were used here. Circle and Tether froze about $320,000 in stablecoins connected to the breach, a small slice of a $387.5 million loss but a clear look at how blacklists behave under pressure.

Exchange cooperation is the slower route. If stolen XRP lands at a platform, that platform can freeze the receiving account and share records with investigators, which turns a cash-out attempt into a paper trail. The attacker's response is to keep moving and to avoid venues that cooperate.

What has not been explained is how the wallets were reached. Bitget said it would not speculate on the attack vector until its investigation is complete, and it has notified authorities and on-chain security firms. That restraint is reasonable, and it also means the question account holders care about most, whether the same opening can be used again, has no public answer yet.

## What Bitget's Protection Fund Covers

Bitget says the loss on this incident falls inside coverage of its User Protection Fund, which the exchange lists at more than $464 million, and that customer balances were not affected. Deposits and trading never stopped. That is why customers are following a withdrawal schedule instead of waiting on a claim.

A protection fund is not the same thing as insurance. It is a pool the exchange controls and describes in its own terms, so the number in the headline matters less than the conditions attached to it. Which incidents qualify, how a payout is valued, and who decides are the parts worth reading before you treat a fund as a guarantee.

## A Custody Checklist for the Next Breach

A four-day withdrawal freeze is a useful moment to check how much of your crypto depends on someone else's wallet architecture.

1. Keep only what you are actively trading on an exchange. Long-term holdings belong in a wallet where you control the keys, and our breakdown of [custody risk at crypto exchanges](https://financetrekker.com/are-crypto-exchanges-safe/) covers what to check before choosing a platform.
2. Separate a protection fund from insurance. One is a promise backed by the operator's own balance sheet and rules, the other is a contract with a third party.
3. Keep emergency cash out of trading accounts. A week-long freeze is survivable for a trading position and painful for rent money, which is the logic behind a funded [emergency fund](https://financetrekker.com/emergency-fund-guide/).
4. Expect follow-up scams. Breaches draw fake recovery services and fake support accounts that ask for a fee or a seed phrase, and the patterns are consistent enough to recognize in advance ([crypto scam patterns](https://financetrekker.com/spot-crypto-scams/)).
5. Save the records. Dates, amounts, and cost basis are what you need if a loss is ever partly recovered or reported, and [the crypto tax guide](https://financetrekker.com/crypto-tax-guide/) shows how crypto reporting fits together.

Bitget customers are not absorbing a loss on this one, because the exchange says its fund takes the hit. The next platform may not carry that cushion, and the difference between an asset that can be frozen and one that cannot will not be announced in advance.

## Sources

- Bitget, [security notice on the September 24, 2026 hot wallet incident](https://www.bitget.com/support/articles/12560603896024), published September 24, 2026.
- CoinDesk, [Bitget hacker moves $83 million in stolen XRP beyond reach of freeze controls](https://www.coindesk.com/markets/2026/09/26/bitget-hacker-moves-usd83-million-in-stolen-xrp-that-ripple-cannot-freeze), by Shaurya Malwa, published September 26 and updated September 28, 2026.

---

Source: https://financetrekker.com/bitget-hack-xrp-freeze-limits/