Bitget Hack: 0.09% Frozen and XRP Cannot Be Frozen

Of the $387.5 million that Bitget reported as transferred to attacker addresses on September 24, 2026, issuers have frozen $339,231.54: exactly 0.09%. This percentage does not measure the diligence of Tether or Circle; it measures the reach of the tool, and that reach failed across two layers. The first is by design: 40.7% of the loot was native XRP, and on the XRP Ledger, freezing does not exist for the native currency—it only applies to tokens issued by someone on that ledger—so nearly 103 million XRP remained beyond the reach of any blacklist (the registry of addresses whose balances are blocked by an issuer) from the very first minute. The second is a matter of timing: of the 22.8% that was indeed freezable by an issuer, the Ethereum-based USDT and USDC—$47.60 million of the $88.28 million freezable—left the initial address within 8 and 16 minutes, and the tokenized gold XAUt within 21 minutes, all of them between 10 and 17 hours before the first blacklist entry existed. What follows measures both layers using the protocol's own documentation, the terms of service of both issuers, and three independent ledger readings separated over time.

How much did Tether and Circle freeze from the Bitget loot?

The central figure is $339,231.54, derived from the tracking dashboard Bitget maintains for the incident, re-examined on September 29, 2026. These are four specific entries across three addresses: two on Ethereum and one on TRON. Tether accounts for $239,241.63 spread across three of them; Circle, $99,989.91 in a single one. None of the four are XRP, and later we will see why it could not be any other way.

The total stolen has two official versions, and both are noted here. Bitget's first notice on September 24, 2026, estimated the outflow at $351.6 million. The following day's notice revised it to $387.5 million by incorporating Zcash and TRON lines, and this is the figure the dashboard continues to use as the total. We use the latter here, along with its date.

On September 25, Bitget offered a reward of 5% of frozen funds and 5% of recovered funds. Based on the figures from September 29, 2026, the full incentive via the freezing route is worth less than $17,000.

Why can no one freeze native XRP on the XRP Ledger?

The protocol's own documentation states it in a sentence that leaves no room for interpretation: "No one can freeze XRP in the XRP Ledger," adding that freezing "does not apply to XRP." The four modalities defined by the ledger (individual, deep, global, and the permanent freeze waiver) all operate on tokens issued by an account and on the trust lines that support them. The native currency has no issuer to appeal to, nor is it subject to multipurpose token blocking or forced recovery—the clawback, the withdrawal of balance by the issuer—which the documentation likewise reserves for issued assets.

The difference with a stablecoin lies in the architecture. USDT on Ethereum is a contract whose state includes a registry of blocked addresses that its issuer can expand at any time: freezing is simply writing an entry in that registry, and the balance continues to exist but stops moving. Native XRP is a unit of the protocol, and the protocol does not expose an equivalent function to anyone. Therefore, a court order, issuer cooperation, or the good faith of a foundation are irrelevant at this layer: there is no one to address.

The same page adds the only nuance that opens a door: custodial exchanges can freeze the funds they custody at any time, at their discretion. This is a different tool with a different prerequisite: the money must reach an exchange and be detected. Bitget's tracking dashboard estimates $214,940.75 deposited in exchange addresses as of September 29, 2026, but does not publish any figure on how much of that has been retained by custodians. The XRP measurable milestones map we published on September 28 did not yet include this case; the incident adds an uncomfortable and verifiable milestone to that list.

What portion of the Bitget loot was freezable by an issuer?

Breaking down the loot by asset class is what makes the 0.09% figure explainable. Our own ledger reading confirms three XRP payments to the main address on September 24, totaling 102,976,680.09 XRP, plus a fourth attempt of 9.14 million that the dashboard marks as failed and was never executed. Stablecoins arrived in four entries across three chains. And there is a portion of tokenized gold, 3,000.32 XAUt, which is also freezable because its issuer is Tether.

Three qualifiers regarding this table. The dollar value of XRP has three versions, all defensible: $157.85 million if applying the implicit valuation from Bitget's graph; and $157.35 million using the hourly close on September 24. A third figure circulating—$152.95 million—has a different basis: it comes from the source share the dashboard assigns to the XRP warm wallet, which only moved 100.73 of the 102.98 million stolen; extended to the three payments, it yields $156.36 million, or 40.35%. Therefore, the hard figure used here is the XRP quantity, which matches to the last decimal between our reading and the dashboard. XAUt is valued using the PAXG close on September 24 as a proxy for the tokenized gold price, as there is no specific XAUt series for that day: the 3.30% share is approximate and depends on that proxy. And Zcash—18,916.72 ZEC stolen, of which 18,669.98 remain unmoved as of September 29, 2026, roughly $28.98 million according to the dashboard—is the only large block without our own reading, as public explorers for that chain limit queries by source address.

With these numbers, the ratio that matters can be calculated across three coherent denominators: 0.09% of the total loot; 0.38% of the $88.28 million an issuer could touch; and 0.45% of stablecoins alone. None of the three reach half a percentage point.

How long did Tether and Circle's blacklists take compared to the outflow?

In the Bitget hack of September 24, 2026, the second layer is measured in durations. USDT entered the first address and left in its entirety 8 minutes and 12 seconds later. USDC entered and left in 15 minutes and 48 seconds, and tokenized gold XAUt in 21 minutes and 24 seconds. The two stablecoin portions that leave no clock in our readings are Arbitrum's USDT0 and Avalanche's USDC, so the measured clock covers $47.60 of the $88.28 million freezable. The first blacklist entries for addresses in that graph arrived the following day: Circle's, 9 hours and 59 minutes after the USDC entry; Tether's, 16 hours and 53 minutes after the USDT entry.

The terms of service of both issuers reserve this right unconditionally: Tether, in the version effective since February 26, 2026, reserves the right to freeze tokens and blacklist addresses; Circle, in the USDC terms updated December 12, 2025, refers to its blocking policy in section 13. What neither document promises is a timeframe. And without a timeframe, the right only reaches money that stays still: the $339,231.54 frozen is in third- and fourth-hop addresses that stopped moving the balance, while the first address was emptied before the order existed.

We discuss the freezing capacity of stablecoin issuers in the abstract in stablecoin risks: it is the counterparty risk that most users accept without reading. This case measures it with a clock, and the result is that the tool arrived between ten and seventeen hours late to the only segment of the loot over which it had jurisdiction.

What was the nature of the 102.98 million XRP drain?

Between the first XRP deposit into the main address on September 24, 2026, and the last second-hop payment on September 27, 60 hours and 41 minutes elapsed, and in that timeframe, the XRP loot from the Bitget hack went from being intact to leaving just 30.31 units. The window for custodial freezing, the only kind that could reach the XRP, closed within that period. Three independent ledger readings, using the same nodes and method, provide the series.

The three wallets that still held balances on September 26 were emptied in series, not in parallel: each began paying out once the previous one had finished, in batches of between six and twenty-two payments per hour. They total 302 outgoing payments to twenty, twenty-one, and twenty-two different destinations respectively, with median amounts between 158,000 and 174,000 XRP.

Of the 343 payments identified across the three readings, none carry a destination tag, the identifier that most centralized exchanges require to credit a deposit to the correct account. This describes the nature of the movement—fragmentation across addresses, not deposits into a platform—and the statement ends there: there is no public source identifying the recipients, so no owner or purpose is attributed to them. One of the intermediate wallets was eventually deleted from the ledger to recover the account reserve, which is an ordinary protocol operation.

The Bitget tracking dashboard also records 110,492,936.07 XRP in gross inflow to THORChain vaults from addresses in the graph, roughly $169.37 million. This figure is higher than the total XRP stolen, and the dashboard itself warns in its methodological note that its infrastructure metric is gross and that the same money may be counted across multiple channels. It is included here as raw dashboard data, without translating to "all XRP passed through THORChain"; the debate on that protocol as an exit route and on transaction censorship is covered in the case of THORChain and laundering after the Bybit hack.

Which Bitget case figures were released with the wrong denominator?

There is not a single dollar of XRP frozen in this case, and there cannot be, so the ratio between frozen funds and the value of stolen XRP lacks a referent: the numerator and denominator belong to different assets. The 0.2% figure that circulated in the early days comes exactly from that ratio, and while the division is correct, the denominator is flawed. It is also untrue that the frozen amount was $318,000: that was a snapshot of a single Ethereum address, and with the other three portions, the total rises to $339,231.54.

Furthermore, the XRP was not still sitting idle on September 26, although it was reported as such: by early that day, 39% had already moved, and 6 hours and 43 minutes later that same afternoon, 56% had moved, measured across two readings with two independent nodes that matched. Any recommendation of the type "let's ask exchanges not to accept that XRP" was born with the window already closing.

In which assets is the Bitget loot held as of Sep-29-2026?

The Bitget tracking dashboard publishes a time series of the graph's composition: it refreshes every 120 seconds, but the series it displays has gaps—249 points in 23.94 hours, with a median of 243 seconds between points and a 7.38-hour jump between 18:36 UTC on September 28 and 01:59 UTC on the 29th. With that caveat, the window from 12:13 UTC on September 28 to 12:09 UTC on September 29, 2026, reveals the direction of the flow: ETH in the graph dropped by $111.39 million and BTC rose by $83.60 million.

On September 29, 2026, the graph distribution is 82.85% in BTC, 8.42% in ZEC, 8.05% in ETH, 0.34% in stablecoins, and 0.33% in ALGO. XRP appears at 0%, with 8,566.52 residual units. The money has ended up concentrated in the asset over which no blacklist has jurisdiction, and it has done so in five days.

Two more figures from the same dashboard refine the cost of all this. Its reconciliation estimates bridge and swap losses at $3,778,395.78, which the dashboard calculates as the difference between what was stolen and what landed in the lines it has managed to square: $3.50 million is concentrated in the swap line on Ethereum-compatible chains. This figure is closed as of September 25, 2026, with some lines squared up to the 27th, and it is 11.1 times what both issuers managed to freeze combined—our own calculation based on the dashboard's figures. And within the $39.32 million that the dashboard classifies as untracked, there are $3.94 million labeled as having passed through CoinJoin transactions on Bitcoin, according to the dashboard's label.

What remains of issuer freezing as a recovery tool?

What remains is a tool with three prerequisites, and the Bitget hack of September 24, 2026, shows how strict they are:

1. That the asset is a token with an issuer, because a native currency lacks an issuer to whom an order can be directed. This condition excluded 77.2% of the loot's entry value.
2. That the chain where the token lives has an active blocking registry and the issuer can write to it.
3. That the balance stays put long enough for someone to detect it, verify it, and sign the order. This condition consumed almost everything else: the segment with a measured clock left the first address in 8, 16, and 21 minutes, while the fastest order took 9 hours and 59 minutes.

What remains active on September 29, 2026, is small, measurable, and moves while being measured. At 12:09 UTC, the dashboard marked $843,242.35 as still freezable in the graph, of which $534,445.92 was in a single Arbitrum address. In the re-reading at 12:46 UTC the same day, that address no longer appears in the freezable list and the total drops to $308,796.43: the difference between the two readings is exactly the balance of that address, $534,445.92, which in 37 minutes went from freezable to moved—our own calculation based on the two readings. What remains is what allows this reading to be verified without waiting for the forensic report: if by October 15, 2026, the total frozen reaches 1% of the stolen amount—$3,875,000—issuer freezing will have been a material recovery route and what is stated here will need correction. We will publish the verification on that day using the same source.

For those holding balances on an exchange, the operational conclusion of the case points beyond Bitget: the freeze button invoked every time there is a hack depends on which asset your balance was in at the moment of the theft, and that detail does not appear in any platform's terms of service. A balance in USDC or USDT has an issuer with blocking capacity and a reaction time that in this case was measured in hours. A balance in XRP, ETH, BTC, or ZEC has none of that, and its only defense after a theft is for the money to land with a custodian willing to look. A review of the sector's largest thefts is in our list of major crypto hacks, and the pattern that 2026 attacks target operational infrastructure rather than contracts is developed in our analysis of 2026 targets.

Sources and links: Bitget, official incident note (Sep-25-2026, revised figure and addresses) · Bitget, first notice from Sep-24-2026 with initial $351.6 million figure · Bitget tracking dashboard, summary endpoint (reading from Sep-29-2026) · XRP Ledger, "Freezes" documentation · Tether, terms of service effective since Feb-26-2026 · Circle, USDC terms updated Dec-12-2025