Bitget‘s attackers barely touched the largest slice of their haul. More than 99% of the 102.97 million XRP drained from the exchange on Sept. 24 was still sitting in five freshly created wallets a day later, according to News.bitcoin, and the XRP Ledger offers no mechanism to lock it down.
Bitget first acknowledged the incident in a Thursday post from CEO Gracy Chen, whose exchange is based in Victoria, Seychelles. Bitcoinmagazine reported that Bitget detected unauthorized transfers from some hot wallets at 18:31 UTC on Sept. 24 and immediately paused withdrawals while the security review runs. The exchange processes over $1.1 billion in daily trading volume, making it the sixth largest platform by that measure.
Also read: Bitget Confirms $351.6M Breach, Withdrawals Frozen
Key facts
- Two Bitget wallets sent 102,976,680 XRP to a single new address beginning rwNhefsz in three payments on Sept. 24 — 2,248,871 XRP at 19:01 UTC, then 91,420,943 XRP fifteen minutes later, then 9,306,866 XRP.
- Only about 400,105 XRP, roughly 0.4% of the haul, had left the attacker’s wallets by Sept. 25; the other four wallets had not moved a coin.
- The attacker split the pile into four wallets of 20 million XRP each and a fifth holding 22,976,677 XRP.
- Bitget said the breach hit “a critical backend system” in its wallet infrastructure; Chen said the three-tier wallet architecture contained the damage to the hot and warm layers and cold wallets stayed secure.
- Bitcoinmagazine reported Hacken later said bitcoin had also been moved, a detail not on Arkham’s initial dashboard, while Chen said deposits and trading remained operational.
Freeze tools that do not reach the native asset
Chen said the exchange has contacted foundations on every affected chain and that a few have already frozen the hacker’s wallet addresses. That approach works for tokens with an issuer behind them, such as USDT or USDC, and it has worked on other networks — Arbitrum froze $71 million tied to the KelpDAO exploit in April, News.bitcoin noted.
XRP is a different case. The XRPL’s freeze tools apply only to issued tokens, not to the native asset, so the biggest single piece of the Bitget haul is the one piece no foundation can touch. Bitget put the total value moved at more than $350 million, a figure Bitcoinmagazine rounded to $351.6 million; the XRP portion accounted for $157.48 million, ahead of 31,890 ETH and roughly $75 million in stablecoins.
Also read: Circle and Tether Freeze $318K of Bitget Hack Funds
That leaves exchanges and bridges as the only chokepoints the attacker must pass through to convert the coins into cash. So far the cash-out has been a trickle: onchain sleuth Yfarmx spotted 33,500 XRP moving through the Bridgers swap service on Sept. 25 and described it as a test run before a bigger cash-out.
The trail toward July and a possible Lazarus link
Chen said IP behavioral patterns and onchain signatures are consistent with techniques used by DPRK-linked hacker groups, while stressing the attacker’s identity is not confirmed. Onchain analyst Specter went further, posting a flow graph that connects ETH paid out by Bridgers for stolen XRP to wallets tagged with the Trader Traitor cluster, which Specter links to July’s AFX attack — a theft of roughly $24 million.
News.bitcoin cautioned that the connection is thin. The graph runs through a single Ethereum wallet holding about $4,300, and small overlaps like that can simply reflect shared laundering services. Security firm Blockaid attributed roughly $609 million of first-half 2026 losses to the Trader Traitor cluster, which is tied to the Lazarus Group.
Each hop in the XRP trail also drew a follow-up payment of 0.00001 XRP from unrelated addresses — a spam pattern typical of address poisoning, where scammers hope someone copies the wrong wallet.
Why it matters
The Bitget case tests a claim exchanges make after every breach: that stolen funds can be locked or covered. For chains with an issuer, freezes and remediation have a track record. For XRP, the ledger’s design means the recovery path runs entirely through the venues the attacker chooses to use, and that makes this haul harder to intercept than the stablecoins and ETH taken in the same raid.
Bitget says its User Protection Fund, which currently holds 5,500 BTC, will cover the loss after assessment — a commitment that now carries a price tag tied to one of the less stoppable assets in crypto. The incident also lands in a year already crowded with losses, including a July attack on a firmware bug in the Coldcard hardware wallet that took nearly $120 million and this month’s withdrawal of about 4,000 bitcoins worth roughly $320 million at the time from Blockstream’s Liquid sidechain federation wallet, both reported by Bitcoinmagazine.
What to watch
Watch the five attacker wallets for the first large movement toward a swap desk or bridge; Yfarmx’s 33,500 XRP test run suggests the next transfer may be larger. Bitget’s completed security review and the size of the User Protection Fund payout will follow, and the exchange has not given a date for resuming withdrawals.
This is not financial advice. Cryptocurrency markets are volatile and uncertain, and prices can move sharply in either direction.
Reported by news.bitcoin.com.
Sources: Bitcoin.com News, Bitcoinmagazine
