{"id":78641,"date":"2026-09-25T08:03:12","date_gmt":"2026-09-25T08:03:12","guid":{"rendered":"https:\/\/crowdfundjunction.com\/blog\/157m-in-stolen-xrp-sits-in-wallets-no-one-can-freeze\/"},"modified":"2026-09-25T08:03:12","modified_gmt":"2026-09-25T08:03:12","slug":"157m-in-stolen-xrp-sits-in-wallets-no-one-can-freeze","status":"publish","type":"post","link":"https:\/\/crowdfundjunction.com\/blog\/157m-in-stolen-xrp-sits-in-wallets-no-one-can-freeze\/","title":{"rendered":"$157M in Stolen XRP Sits in Wallets No One Can Freeze"},"content":{"rendered":"<p><b>(Originally posted on : Bitcoin News )<\/b><br \/>\n<\/p>\n<div>\n<div class=\"@container mb-[25px] rounded-sm overflow-clip py-0.5 pr-0.5 pl-2.5 bg-success-100\">\n<div class=\"flex flex-col gap-m overflow-clip rounded-[6px] !bg-success-10 p-3 @[420px]:p-m\">\n<h2 class=\"m-0 flex items-center gap-s text-[19px] !text-[#1c1c1c] md:text-[20px]\"><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"16\" height=\"10\" viewbox=\"0 0 16 10\" fill=\"none\" class=\"shrink-0 text-success-100\" aria-hidden=\"true\"><path d=\"M1 1.5h14\" stroke=\"currentColor\" stroke-width=\"2.5\" stroke-linecap=\"round\"\/><path d=\"M1 8.5h10\" stroke=\"currentColor\" stroke-width=\"2.5\" stroke-linecap=\"round\"\/><\/svg><span>Key Takeaways<\/span><\/h2>\n<ul class=\"m-0 flex list-none flex-col gap-m pl-0\">\n<li class=\"m-0 flex items-start gap-s !text-[#434248]\"><span class=\"mt-2 size-2 shrink-0 rounded-full bg-success-100\" aria-hidden=\"true\"\/><span class=\"text-body\">Two Bitget wallets sent 102,926,478 XRP to a single new address in three payments on Sept. 24.<\/span><\/li>\n<li class=\"m-0 flex items-start gap-s !text-[#434248]\"><span class=\"mt-2 size-2 shrink-0 rounded-full bg-success-100\" aria-hidden=\"true\"\/><span class=\"text-body\">Only about 400,000 XRP, roughly 0.4% of the haul, had left the attacker\u2019s wallets by Sept. 25.<\/span><\/li>\n<li class=\"m-0 flex items-start gap-s !text-[#434248]\"><span class=\"mt-2 size-2 shrink-0 rounded-full bg-success-100\" aria-hidden=\"true\"\/><span class=\"text-body\">Onchain analyst Specter has tied the XRP trail to July\u2019s $24M AFX hack, hinting at North Korea\u2019s Lazarus Group.<\/span><\/li>\n<\/ul>\n<\/div>\n<\/div>\n<h2>Three Payments, One Address<\/h2>\n<p>Bitget said attackers broke into \u201ca critical backend system\u201d inside its wallet infrastructure, spoofed transaction data and <a href=\"https:\/\/news.bitcoin.com\/security\/bitget-hit-by-351m-hack-withdrawals-frozen-as-probe-begins\/\">pushed over $350 million<\/a> out of its hot and warm wallets. The biggest single slice was XRP and onchain trackers <a href=\"https:\/\/x.com\/lookonchain\/status\/2103290466116763936\" target=\"_blank\" rel=\"noopener noreferrer\">counted 102.93 million<\/a> XRP worth $157.48 million, well ahead of the 31,890 ETH and roughly $75 million in stablecoins that also left.<\/p>\n<p>The XRP Ledger (XRPL) shows exactly how it happened:<\/p>\n<p>Adding them up comes to 102,976,680 XRP, the exact number one watcher <a href=\"https:\/\/x.com\/ShortTheFOMO\/status\/2103246613783396724\" target=\"_blank\" rel=\"noopener noreferrer\">flagged that night<\/a>.<\/p>\n<p>Lastly, it bears mentioning that the attacker has split the pile into four wallets holding 20 million XRP each and a fifth holding 22,976,677 XRP. Each hop drew a follow-up payment of 0.00001 XRP from unrelated addresses, a spam pattern typical of address poisoning, where scammers hope someone copies the wrong wallet.<\/p>\n<h2>The Freeze That Can\u2019t Happen<\/h2>\n<p>Bitget CEO Gracy Chen said the <a href=\"https:\/\/x.com\/GracyBitget\/status\/2103359608484172104\" target=\"_blank\" rel=\"noopener noreferrer\">exchange has contacted foundations<\/a> on every affected chain and that a few have \u201calready frozen the hacker\u2019s wallet addresses.\u201d That works for tokens with an issuer behind them, such as USDT or USDC. It has worked on other networks too; i.e. Arbitrum froze $71 million tied to the <a href=\"https:\/\/news.bitcoin.com\/lazarus-group-suspected-of-moving-175m-in-eth-after-arbitrum-freezes-71m-from-kelpdao-exploit\/\">KelpDAO exploit<\/a> in April.<\/p>\n<p>XRP, however, is a different animal given that no one can freeze the asset once part of the ledger. The XRPL\u2019s freeze tools apply only to issued tokens, not to the native asset. That means the largest chunk of the Bitget haul is the one piece no foundation can touch. The only chokepoints left are the exchanges and bridges the attacker has to pass through to cash out.<\/p>\n<h2>The Thread Back to July And a Possible Lazarus Connection<\/h2>\n<p>Chen said <a href=\"https:\/\/x.com\/GracyBitget\/status\/2103359608484172104\" target=\"_blank\" rel=\"noopener noreferrer\">IP behavioral patterns<\/a> and onchain signatures are \u201cconsistent with techniques used by DPRK-linked hacker groups,\u201d while stressing the attacker\u2019s identity isn\u2019t confirmed. Onchain analyst Specter went further, posting a <a href=\"https:\/\/x.com\/SpecterAnalyst\/status\/2103286738961486186\" target=\"_blank\" rel=\"noopener noreferrer\">flow graph<\/a> that connects ETH paid out by the Bridgers swap service for stolen XRP to wallets tagged with the Trader Traitor cluster. Specter links those funds to the AFX attack in July, a roughly $24 million theft.<\/p>\n<p><\/p>\n<p>The connection is still thin since the graph runs through a single Ethereum wallet holding about $4,300, and small overlaps like that can simply reflect shared laundering services. Still, the pattern fits and security firm Blockaid attributed roughly <a href=\"https:\/\/news.bitcoin.com\/security\/security-firm-blockaid-says-212-onchain-exploits-stole-1-1b-as-ai-and-wallet-attacks-accelerate\/\">$609 million<\/a> of first-half 2026 losses to the Trader Traitor cluster, which is tied to the Lazarus Group.<\/p>\n<h2>A $157 Million Overhang<\/h2>\n<p>So far, the cash-out has been a trickle and onchain sleuth Yfarmx <a href=\"https:\/\/x.com\/YFarmX\/status\/2103293878006923667\" target=\"_blank\" rel=\"noopener noreferrer\">spotted 33,500 XRP moving<\/a> through Bridgers on Sept. 25 and called it \u201ca test run before a bigger cash-out.\u201d The ledger now shows about 400,105 XRP gone from one of the five wallets, while the other four haven\u2019t moved a single coin.<\/p>\n<p>XRP is trading at $1.53 today, up 1.4% since yesterday, so the market has shrugged the development for now. That could change quickly if tens of millions of XRP start hitting swap desks. The mood was already fragile, and Bitcoin.com News reported recently that the average <a href=\"https:\/\/news.bitcoin.com\/market-updates\/xrp-average-long-term-trader-still-down-11-75-after-rebound\/\">long-term XRP trader<\/a> is still down 11.75% even after XRP\u2019s recent rebound.<\/p>\n<p>Bitget says its User Protection Fund will cover the loss after assessment. That fund currently holds 5,500 BTC.<\/p>\n<\/p><\/div>\n<p><a href=\"https:\/\/news.bitcoin.com\/exchanges\/bitget-hack-xrp-157m-cannot-be-frozen\/\">Source link <\/a><br \/>\n<br \/><\/p>\n","protected":false},"excerpt":{"rendered":"<p>(Originally posted on : Bitcoin News ) Key Takeaways Two Bitget wallets sent 102,926,478 XRP to a single new address in three payments on Sept. 24. Only about 400,000 XRP, roughly 0.4% of the haul, had left the attacker\u2019s wallets by Sept. 25. Onchain analyst Specter has tied the XRP trail to July\u2019s $24M AFX [&hellip;]<\/p>\n","protected":false},"author":3947362404,"featured_media":78642,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0},"categories":[32],"tags":[],"_links":{"self":[{"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/posts\/78641"}],"collection":[{"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/users\/3947362404"}],"replies":[{"embeddable":true,"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/comments?post=78641"}],"version-history":[{"count":0,"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/posts\/78641\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/media\/78642"}],"wp:attachment":[{"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/media?parent=78641"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/categories?post=78641"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/tags?post=78641"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}