Over 102 million XRP, valued at $157.48 million, was drained from Bitget on September 24 through what the exchange described as a breach of a critical backend system in its wallet infrastructure. The attacker used spoofed transaction data to move the funds across three separate transfers to a single new address.
According to blockchain records, the XRP Ledger shows exactly how the theft unfolded. A labeled Bitget Global wallet sent 2.25 million XRP to a new address at 19:01 UTC, followed by a second transfer of 91.42 million XRP fifteen minutes later, and a third transfer of 9.31 million XRP. The attacker subsequently split the total across five wallets, each containing either 20 million XRP or 22.98 million XRP.
As of September 25, only about 400,000 XRP, roughly 0.4% of the stolen amount, had left the attacker's wallets. The remaining funds have not moved.
XRP Cannot Be Frozen Unlike Other Stolen Assets
Bitget CEO Gracy Chen stated that the exchange contacted foundations across affected blockchains, with some already freezing hacker wallet addresses for tokens like USDT and USDC. However, XRP presents a unique challenge. The XRP Ledger's freeze tools apply only to issued tokens, not to the native asset itself, meaning no foundation can freeze the stolen XRP.
This limitation leaves exchanges and bridges as the only remaining chokepoints to prevent the attacker from converting the stolen XRP into other assets.
Possible Connection to Earlier Hack
Bitget CEO Chen noted that IP behavioral patterns and onchain signatures are consistent with techniques used by hacker groups linked to North Korea, while emphasizing the attacker's identity has not been confirmed. Onchain analyst Specter connected ETH paid out through the Bridgers swap service for stolen XRP to wallets tagged with the Trader Traitor cluster, linking the funds to an AFX attack in July that resulted in approximately $24 million in losses. Security firm Blockaid attributed roughly $609 million of first-half 2026 losses to the Trader Traitor cluster, which has been tied to the Lazarus Group.
Market Response and User Protections
XRP has traded largely flat following the hack, with minimal movement from the stolen funds suggesting a cautious approach by the attacker. Bitget stated that its User Protection Fund, which currently holds 5,500 BTC, will cover losses following assessment.
