BitGo, Which Activated the Evernorth Wallet, Now Creating Thousands of XRP Wallets a Day

Over the past several days, the BitGo Initialization Wallet, which activated the Evernorth address, has exhibited unusual on-chain activity. 

Data shows that this wallet continuously created and activated multiple new addresses, each funded with exactly 1.2225 XRP. Notably, this amount served as the reserve requirement, leaving each new address with a balance of zero.

BitGo Creating Thousands of XRP Wallets a Day

Investigations revealed that this behavior occurred relentlessly for days, with the BitGo-linked wallet creating between eight and twelve new wallets every minute, nonstop, for several days. 

Vet, a validator on the XRPL’s default Unique Node List (dUNL), first called the community’s attention to the anomaly on Nov. 7. In a public disclosure, Vet noted that BitGo had been activating thousands of XRP accounts in bulk over several days. The validator also observed unusual spikes in certain transaction types on the network.

A Spike in Major XRPL Metrics

Specifically, this series of actions noticeably impacted key XRP Ledger metrics, according to data from XRPScan. For instance, the number of AccountSet transactions, which typically averages around 300 per day, surged dramatically to 14,859 on Nov. 2.

It later fell to 3,466 two days afterward before climbing again to 40,333 on Nov. 6, marking the highest daily count since July 2014. After this peak, the metric briefly dropped but rose once more to 26,105 on Nov. 11.

Similarly, the number of newly created and activated accounts, which usually averages 4,300 per day, rose sharply to 11,242 on Nov. 2. The number then dipped back to average levels before spiking again to 13,300 on Nov. 11, the largest daily increase since January of this year.

What Exactly Happened?

In a follow-up post, Vet shared that the situation appeared to come from a faulty BitGo script. According to the validator, BitGo’s system had entered an endless loop that continued to attempt wallet activations even after the main wallet’s XRP balance was drained. This issue led to a flood of failed transactions on the XRPL after 14:03 on Nov. 11.

Lmao turns out BitGo just had a rogue script and now spams the ledger with failed transactions.

Because their account ran out of XRP 😭.

Devs made infinite while loops 🔁 https://t.co/aBfDjFiKa7 pic.twitter.com/TDpKbaQDeR

— Vet 🏴‍☠️ (@Vet_X0) November 11, 2025

BitGo acknowledged the report, noting that its team had already begun investigating the cause. Nonetheless, as of press time, BitGo has not responded to requests from The Crypto Basic for further comment regarding the incident.

Meanwhile, the XRPScan team explained that BitGo has a history of pre-funding new accounts in bulk as part of its operational process. However, it noted that the firm typically manages accounts for institutional clients rather than retail users.

XRPScan also pointed to a past occurrence in November 2019, when the XRP reserve fee was 20 XRP instead of the current 1 XRP. 

At that time, network participants observed that BitGo had been activating multiple accounts funded with 25 XRP each. XRPScan clarified at the time that the activity represented a standard BitGo procedure for pre-seeding accounts to assign them to customers from a pool of newly created addresses.