Bitget Hackers Sit on $157M in Stolen XRP

Bitget, a major cryptocurrency exchange, was hacked on September 24, resulting in the theft of over $157 million worth of XRP. The attackers broke into 'a critical backend system' inside Bitget's wallet infrastructure and spoofed transaction data to push over $350 million out of its hot and warm wallets.

The largest single slice of the haul was XRP, with 102.93 million tokens stolen. This is roughly three times more than the next-largest asset, ETH, which saw 31,890 tokens stolen. Bitget CEO Gracy Chen stated that the exchange has contacted foundations on every affected chain and that a few have 'already frozen the hacker's wallet addresses,' but this does not apply to XRP.

XRP is a unique case because its ledger has no switch to lock it once it's part of the ledger, meaning the largest chunk of the Bitget haul remains untouched. The only chokepoints left are the exchanges and bridges the attacker must pass through to cash out. Chen also stated that IP behavioral patterns and on-chain signatures are 'consistent with techniques used by DPRK-linked hacker groups,' but stressed that the attacker's identity hasn't been confirmed.

Onchain analyst Specter has tied the XRP trail to July's $24M AFX hack, hinting at North Korea's Lazarus Group. The connection is still thin, but security firm Blockaid attributed roughly $609 million of first-half 2026 losses to the Trader Traitor cluster, which is tied to the Lazarus Group.