Stolen XRP: what can be traced and frozen on the XRP Ledger

Not on the ledger. The XRP Ledger documentation states that no one can freeze XRP, because it is the ledger's native asset rather than an issued token, and that XRP Ledger payments are irreversible.

The same documentation adds that custodial exchanges can always freeze the funds they custody at their own discretion. So the realistic question isn't whether XRP can be frozen, but whether the stolen XRP reached an exchange.

Exchanges usually receive all customers' XRP at a shared address and use a destination tag to tell which customer to credit. The XRPL documentation describes this as providing hosted accounts, and exchanges can set their address to reject payments that arrive without a tag.

In practice, that means a deposit to an exchange address with a destination tag corresponds to a particular customer in the exchange's own records. The exchange won't share that with you, but it is exactly what law enforcement or a court can ask for. A trace should record the destination tag on every exchange deposit.

Tokens issued on the XRP Ledger can be frozen by their issuer. An issuer can freeze an individual holder's trust line, freeze all its tokens at once, or apply a deep freeze that also stops the holder receiving more. Issuers can also enable clawback, which lets them recover tokens after distribution, but only if they turned it on before issuing any tokens. Issuers can also give up freezing for good with the No Freeze setting.

Ripple's RLUSD terms say Ripple may freeze RLUSD by blacklisting an address, may burn RLUSD held in a wallet and mint replacement tokens to another wallet, and intends to cooperate with legal process and law enforcement requests. Ripple's RLUSD issuing account on the XRP Ledger has clawback enabled.

• —Record every transaction hash, the sending and receiving addresses, any destination tags, the amounts and the times.
• —If your secret key or recovery phrase was exposed, treat the account as compromised and move anything left to a new one. Our wallet-drained guide covers the first steps.
• —Report it to the police and to the IC3 (or Report Fraud in the UK) with those details.
• —If the funds went to an exchange, report it to that exchange with the deposit address and destination tag.
• —If the stolen asset was RLUSD or another issued token, note the issuer: depending on its settings, it may be able to freeze the tokens at law enforcement's request.

We trace on the XRP Ledger as well as UTXO, EVM, Tron and Solana chains, following funds across chains where they were bridged or swapped. On the XRPL that includes recording destination tags on exchange deposits and identifying issued tokens that their issuer can freeze. The intake review is free.