$83 Million in Stolen XRP Flows Out of Original Attacker Accounts

On September 26, about $83 million in XRP left the five original attacker accounts used to hold the stolen funds from Bitget. This development shifts the focus of the recovery effort towards custodial gateways, which can identify and stop the control of these funds.

The roughly 54 million XRP that exited the first holding accounts represents only a portion of the total $83 million, as about 49 million XRP remains in those original accounts. The movement of these funds is not necessarily equivalent to cashing out, but rather redistribution among attacker-controlled wallets or towards exchanges.

The limitation on freezing native XRP balances lies in how the XRP Ledger treats its native asset, with no issuer that can blacklist an account. This means Ripple and validators have no built-in authority to mark these accounts as frozen, making exchange deposits a crucial intervention point.