BITGET BEGGED A PERMISSIONLESS PROTOCOL TO FREEZE $387 MILLION IN STOLEN COINS — THE HACKER’S EXIT WAS BITCOIN 

Quick Summary

• Bitget, a centralized crypto exchange, lost $387.5 million to a hacker. The stolen XRP — roughly 103 million tokens taken on Thursday — was split across five accounts.
• By 12:41 UTC Saturday, two wallets that each held 20 million XRP were down to about 23 tokens and 55 tokens. A third was down to roughly 5.8 million. According to CoinDesk, about $83 million has already moved.
• Bitget then asked THORChain — a permissionless cross-chain swap protocol — to block the hacker’s addresses. THORChain declined, citing its permissionless design. Per The Defiant, an address Bitget flagged completed an XRP-to-bitcoin swap after the request was made.
• Circle and Tether, which both run freeze buttons on their own stablecoins, managed to freeze a combined $320,000 — about 0.08% of the haul.
• Ripple cannot freeze XRP itself. The XRP Ledger lets issuers freeze tokens they issued — not the native asset. There is no admin key for the money.

What Happened

Let’s be blunt about the sequence of events, because the sequence is the story.

A centralized exchange got robbed. Attackers walked off with an amount Bitget first estimated at $388 million, then revised to $387.5 million on Friday after admitting they’d missed Zcash and TRON transfers in the initial accounting. Customer withdrawals are still throttled: Bitcoin resumes September 28, ether on the 29th, USDT on the 30th, everything else by October 2. Bitget says its protection fund covers the loss and customer balances are unaffected.

Fine. That is how the custodial model is supposed to work. But here is the part nobody wants to say out loud: the exchange then picked up the phone and asked a decentralized protocol to un-rob it.

According to The Defiant, Bitget asked THORChain to block the addresses tied to the hack. THORChain said no — citing the whole point of its design, which is that nobody gets to decide whose transactions are valid. Then a wallet Bitget had already flagged completed an XRP-to-bitcoin swap anyway. The address did not care about the letter Bitget sent. It didn’t have to. That’s the design.

The reaction from the rest of the industry was the funniest part. OKX’s Star Xu publicly went after THORChain for having the nerve to compare itself to Bitcoin — as if the comparison were the offending act, and not the fact that a hacked exchange thought a permissionless network owed it a customer service department.

Meanwhile the stablecoin issuers showed exactly where centralized power still works. Circle and Tether froze roughly $320,000 in connected stablecoins. That is real money to the people holding it, and it is also eight hundredths of one percent of the theft. Two companies that can blacklist any address they like, and the best they could do was pick off pocket change while the rest of it walked.

And the XRP itself? Ripple cannot freeze it. Not “will not” — cannot. The XRP Ledger gives issuers control over tokens they issue. The native asset has no such switch. So the hacker is spending it, publicly, in real time, while the exchange that lost it asks other people to make it stop.

Why This Matters for Bitcoin

Notice what route the exit took: XRP in, Bitcoin out. The loot didn’t get swapped for another exchange token or another corporate chain asset. It got converted into the one asset that has no issuer, no foundation, no compliance desk and no ability to claw anything back.

This is not the first time. We documented the Coldcard thief pushing stolen coins through THORChain before, and North Korea’s crews have cashed out tens of millions in stolen Bitcoin through the same kind of rails. Whenever a thief wants an exit that cannot be reversed, the exit is Bitcoin. Every single time.

That is the exact property the Bitcoin crowd screams about when there’s a fork war, and it’s the same property that makes a hack unstoppable once the coins land. You cannot have one without the other. A network where a hacked exchange can get your transactions reversed is a network where a government, a corporation or a creditor can get your transactions reversed too. Bitcoin chose: no freeze button.

Which is why the exchange model keeps producing this exact press release. Look at what a single cloud outage did to Coinbase customers — no hack required, just one provider having a bad day. Look at the Zonda cold-wallet crisis. And then look at the other direction — the chains that DO have a freeze button, like Liquid, where $47 million of user Bitcoin is still sitting in a hacker’s wallet while the network it was supposedly secured by stays frozen. Freezing the network didn’t return the coins to the users. It just froze everybody.

So pick a side, because the industry keeps pretending you don’t have to. Either a network has administrators who can be petitioned, subpoenaed and leaned on — or it doesn’t. Bitget just spent $387.5 million finding out which kind it was dealing with.

The Love Is Bitcoin Takeaway

Bitget’s protection fund will cover the loss. That is genuinely the best-case outcome for a custodial failure, and it deserves credit. But the protection fund covered it because Bitget chose to. There’s no law that made it. There’s no protocol that enforced it. The same hands that can make you whole can also decide one day not to — and when that day comes, the only thing between your stack and a bankruptcy filing is whether the coins were ever really yours.

That is the entire difference between holding Bitcoin and holding a claim on Bitcoin:

• A claim sits on somebody else’s balance sheet. It comes with withdrawal limits, staged resume dates and a support queue. It is a promise, and promises are priced in counterparty risk.
• A key sits in your hand. No withdrawals queue, no freeze request, no one to petition — and nobody who can petition to freeze you either.

Notice the symmetry, because it’s the part maximalists are accused of glossing over: Bitcoin has no undo button, so stolen coins stay stolen. And because there’s no undo button, nobody can stop you from spending your own money. Same switch. Both consequences. You can’t ask for the first without handing someone the second.

The Bitcoin in that hacker’s wallet used to be somebody’s XRP on somebody’s exchange. It isn’t anymore. Somewhere in that chain of custody, the coins passed from “a database entry we can freeze” into “money that is simply gone.” Learn where that line is before your stack crosses it.

What Beginners Should Do Next

• Understand what you actually own on an exchange. It’s not Bitcoin. It’s a number in a company’s database plus a terms-of-service promise. If you can’t withdraw it right now, and you didn’t choose that, you know which side of the line you’re on.
• Learn self-custody before the emergency, not during it. An exchange halting withdrawals is a terrible time to research wallet setup for the first time. Start with how to choose a Bitcoin wallet that fits your threat model.
• Split your stack by purpose. Trading money can live where it’s convenient. Savings shouldn’t. A hardware wallet plus a written-down seed phrase kept offline means an exchange breach is somebody else’s bad week, not your ruin.
• Stop treating “they’ll make it right” as a security model. Protection funds are discretionary, unfunded in a worst case, and meaningless in a total failure. Self-custody has exactly one failure mode — you — and that’s the one you can actually practice for.
• Remember what happened to the people who asked the network nicely. In this story the request came from a nine-figure company with lawyers and a PR team, and it was still ignored. You will not have better luck.

FAQ

Did THORChain break the law by refusing?
THORChain isn’t an exchange with a compliance department. It’s a protocol with no entity to compel. That’s not a legal opinion — it’s the practical reason the request had nowhere to land.

Why couldn’t Ripple freeze the stolen XRP?
The XRP Ledger gives issuers freeze control over tokens they issue. XRP itself is the native asset, so there’s no switch to flip. Ripple can’t block an attacker from spending XRP held in the attacker’s own wallet.

What’s the point of stablecoin freeze buttons then?
They work — just narrowly. Circle and Tether froze about $320,000 out of a $387.5 million theft. A freeze power only covers the assets its issuer controls, and it only helps for as long as the crooks leave their money in those tokens.

Are Bitget customers going to get their money back?
Bitget says the protection fund covers the loss and balances are unaffected, with withdrawals resuming in stages from September 28 through October 2. That’s a corporate promise being honored — the good version of custody. It is still a promise.

Isn’t unstoppable theft bad for Bitcoin?
Yes — and it’s the same switch that makes your coins unfreezable. Every chain with a clawback is a chain where the wrong people eventually get the clawback. Choose which risk you’d rather carry.

Is this financial advice?
No. This article is for education only and is not financial advice.

Final Thoughts

A $387.5 million breach, a protocol that publicly refused to police it, two stablecoin issuers freezing pocket change, and a hacker converting other people’s money into the one asset that can never be taken back.

Every headline in the crypto press will frame this as a hack story. It isn’t. It’s a custody story — because the coins didn’t leave the industry, they left the custodians.

So here’s the question, and I want it in the comments: when a nine-figure exchange with lawyers, insurers and a protection fund can’t get a stolen coin back, what exactly do you think your account balance is protecting you from — and how much are you willing to move to keys that nobody can petition to freeze? Because there are two kinds of Bitcoin holders after a week like this: the ones who are the bank, and the ones who are the customer.

⚡ Hold your own keys — get the tools with coupon code LOVEISBITCOIN at loveisbitcoin.com/bull ⚡

Sources: CoinDesk reporting on the Bitget breach and the unfreezable XRP (Sept 26, 2026) and The Defiant reporting on THORChain declining Bitget’s block request (Sept 27, 2026).