Bitget, one of the world's largest crypto exchanges, said in its security notice on Sept. 25 that hackers stole about $351.6 million from its hot and warm wallets on Sept. 24, with XRP accounting for the single biggest part of the loss.
- Lookonchain, an on-chain analytics account, estimates the attackers took more than 102 million XRP, worth about $157 million, or roughly 45% of Bitget's reported loss.
Bitget detected unauthorized transfers at 6:31 p.m. UTC on Sept. 24 and temporarily suspended withdrawals. Deposits and trading remained available.
The exchange says its cold wallets were unaffected and its $464 million-plus User Protection Fund is large enough to cover the loss.
Gracy Chen, Bitget's CEO, later said in an X post that "private key compromise has been ruled out."
Here is what we can confirm at this stage:
— Gracy Chen @Bitget (@GracyBitget) September 25, 2026
On the attack:
Our security team has made initial progress in tracing the source. The attacker compromised a critical backend system within our wallet infrastructure, used it to spoof transaction data, and triggered our authorization… https://t.co/5nINjwbXpC
According to her preliminary account from another X post, the attackers compromised a critical backend wallet system, manipulated transaction information and triggered Bitget's own authorization process to sign the transfers. The exact entry point is still under investigation.
关于攻击原因：… https://t.co/4toExB6AYX
— Gracy Chen @Bitget (@GracyBitget) September 25, 2026
Chen also said the attack resembles known North Korean hacking operations "based on IP behavior patterns and on-chain analysis," though that attribution remains preliminary. The exchange is already working with third-party experts Mandiant and SlowMist for a full investigation, the Bitget CEO said.
What's known so far
The stolen assets included XRP, ETH, USDT, USDC, BNB and AVAX across the XRP Ledger, Ethereum, Arbitrum, Avalanche, Optimism, BNB Smart Chain and Base.
Chen said Bitget contacted organizations behind the affected networks and that some had confirmed freezes involving hacker addresses.
Some stolen funds may also be recoverable, Chen said, without giving a figure. Withdrawals remain suspended while Bitget completes its security review.
The key problem
But that freezing strategy can't work on-chain for the largest stolen asset.
XRP is the native currency of the XRP Ledger. And the network's official documentation is explicit:
That doesn't make the stolen XRP untouchable as centralized exchanges can still blacklist hacker addresses or freeze XRP once it enters accounts they control, the documentation reads.
But the nearly 103 million XRP itself can't simply be frozen at the blockchain level, leaving Bitget dependent on tracking the funds and getting exchanges or other custodians to stop the attackers when they try to cash out.
- The Coinformer reached out to Bitget for comments on the matter and will update the story once the exchange responds.