The freeze button exists, but in crypto, having the power to stop a thief and actually being able to use it are two different things.
The Summary
- A hacker is actively draining $83 million in stolen XRP from Bitget wallets, with two wallets almost emptied and a third being siphoned as funds move beyond Ripple's freeze controls
- Ripple has the technical ability to freeze XRP addresses but cannot intervene once funds move to self-custody wallets or non-compliant exchanges
- About $75 million still remains across five original holding accounts, suggesting the attacker is methodically extracting funds in stages
The Signal
The Bitget hack exposes the fundamental tension in blockchain design between user control and institutional oversight. Ripple maintains a freeze function built into the XRP Ledger, a feature that makes compliance officers sleep better but gives crypto purists heartburn. The problem is that freeze powers only work on addresses that play by the rules. The moment stolen funds land in a self-custody wallet or an exchange that ignores Ripple's requests, that freeze button becomes decorative.
Two of the five original wallets holding the stolen XRP have been nearly emptied. A third is being drained in real time. The hacker is moving methodically, not frantically, which suggests they understand exactly where Ripple's reach ends. They are routing funds through pathways designed to break the chain of reversibility.
"Having the power to stop a thief and actually being able to use it are two different things."
This is not a flaw in XRP's design, exactly. It is the design working as intended. The freeze function exists for regulated entities and cooperating parties. It was never meant to be a universal undo button for the entire ledger. But that nuance gets lost when $83 million is walking out the door and the company behind the protocol can only watch.
The remaining $75 million sits in accounts the hacker has not yet touched. Either they are waiting for attention to die down, or they are spacing out withdrawals to avoid triggering automated monitoring systems at the exchanges they plan to use. Both strategies suggest patience and planning.
Key dynamics at play:
- Freeze powers are only effective within the perimeter of compliant actors
- Self-custody wallets operate outside that perimeter by design
- The hacker's staged withdrawal pattern indicates operational discipline, not panic
The Implication
If you are building on a blockchain with emergency controls, understand that those controls are only as good as the network of institutions willing to honor them. Ripple's freeze function is real, but its jurisdiction is limited. The moment funds move to wallets or platforms outside that jurisdiction, the safety net disappears. This is not a bug, it is the inevitable result of a system where self-custody is a first-class feature.
For users holding assets on centralized exchanges, this hack is a reminder that your funds are only as secure as the platform's operational security and the blockchain's ability to intervene after a breach. Ripple can freeze some addresses. It cannot freeze all of them. And the ones it cannot freeze are exactly where a competent attacker will send your money.