Bitget Says $351.6M Wallet Breach Took 102.93M XRP; Attacker Linked to North Korea
Bitget says a backend wallet breach on Sept. 24 drained about $351.6M, mostly XRP, and it is investigating a North Korea link.
Read this event in português (Brasil), Türkçe
Why it matters
A loss near $352 million to $388 million could take roughly 76% of Bitget's $464 million protection fund, CryptoSlate reported, which is the mechanism that keeps customer balances whole. The inability of the XRP Ledger to freeze a stolen balance, which issuer-backed stablecoins can be, leaves most of the haul traceable only by its movement between wallets.
Where the sources disagree
Total value of the Bitget breach
$351.6 million
The Crypto Basic, CoinGape, Crypto News (CryptoNews.net), Finbold, CryptoSlate
$387.5 million
CoinDesk
Bitget's initial estimate was about $351.6 million while CoinDesk later described the same breach as $387.5 million.
How much of the stolen XRP moved out
about 400,000 XRP moved by Sept. 25
Bitcoin.com News
about $83 million in XRP moved by 12:41 UTC Saturday
CoinDesk
27.63 million XRP moved onward by 02:54 UTC Sept. 26
CryptoSlate
roughly 27 million XRP worth more than $80 million relocated
Bitcoin Insider
Bitcoin.com found about 400,000 XRP out of the attacker's wallets by Sept. 25, while CoinDesk and Bitquery later reported tens of millions of XRP moved onward, so the figures describe different dates.
Lazarus Group attribution
Lazarus Group suspected behind the attack
CoinGape, Finbold
Specter linked the XRP to the $24 million AFX hack; Bitget attribution not yet independently confirmed
CryptoSlate
Bitget's CEO and onchain analysts suspect Lazarus Group, but the attribution has not been independently confirmed and rests partly on a single analyst's link to the July AFX hack.
Figures that do not reconcile
Found by comparing the numbers in the reports automatically. They are differences, not yet confirmed to be about the same thing.
amount taken (bitget)
$351.6 million
The Crypto Basic
$158 million
CoinGape
The Crypto Basic reports $351.6 million, CoinGape reports $158 million (55% apart).
amount taken (bitget)
$351.6 million
The Crypto Basic
$157 million
Finbold
The Crypto Basic reports $351.6 million, Finbold reports $157 million (55% apart).
amount taken
$157.48 million
The Crypto Basic
$352 million
CryptoSlate
The Crypto Basic reports $157.48 million, CryptoSlate reports $352 million (55% apart).
amount taken (stolen)
67,982 ETH
The Crypto Basic
31,890 ETH
CoinGape
The Crypto Basic reports 67,982 ETH, CoinGape reports 31,890 ETH (53% apart).
reported value
$183 million
The Crypto Basic
$350 million
Bitcoin.com News
The Crypto Basic reports $183 million, Bitcoin.com News reports $350 million (48% apart).
reported value
$183 million
The Crypto Basic
$350 million
Crypto News (CryptoNews.net)
The Crypto Basic reports $183 million, Crypto News (CryptoNews.net) reports $350 million (48% apart).
size of the holdings
$188.93 million
The Crypto Basic
$464 million
Finbold
The Crypto Basic reports $188.93 million, Finbold reports $464 million (59% apart).
amount taken (bitget)
$157
CoinGape
$351.6
CryptoSlate
CoinGape reports $157, CryptoSlate reports $351.6 (55% apart).
amount taken (bitget)
$158 million
CoinGape
$351.6 million
Crypto News (CryptoNews.net)
CoinGape reports $158 million, Crypto News (CryptoNews.net) reports $351.6 million (55% apart).
amount taken (bitget)
$158 million
CoinGape
$352 million
CryptoSlate
CoinGape reports $158 million, CryptoSlate reports $352 million (55% apart).
amount taken
$351 million
CoinGape
$157 million
Finbold
CoinGape reports $351 million, Finbold reports $157 million (55% apart).
amount taken (bitget)
$351.6 million
Crypto News (CryptoNews.net)
$157 million
Finbold
Crypto News (CryptoNews.net) reports $351.6 million, Finbold reports $157 million (55% apart).
amount taken
$157.48 million
Crypto News (CryptoNews.net)
$352 million
CryptoSlate
Crypto News (CryptoNews.net) reports $157.48 million, CryptoSlate reports $352 million (55% apart).
reported value
$183 million
Crypto News (CryptoNews.net)
$350 million
Bitcoin.com News
Crypto News (CryptoNews.net) reports $183 million, Bitcoin.com News reports $350 million (48% apart).
size of the holdings
$188.93 million
Crypto News (CryptoNews.net)
$464 million
Finbold
Crypto News (CryptoNews.net) reports $188.93 million, Finbold reports $464 million (59% apart).
amount taken (bitget)
$157
Bitcoin.com News
$351.6
CryptoSlate
Bitcoin.com News reports $157, CryptoSlate reports $351.6 (55% apart).
amount taken
99%
Bitcoin.com News
76%
CryptoSlate
Bitcoin.com News reports 99%, CryptoSlate reports 76% (23% apart).
amount taken (bitget hack)
$352 million
CryptoSlate
$157 million
Finbold
CryptoSlate reports $352 million, Finbold reports $157 million (55% apart).
amount taken (bitget)
$351.6
CryptoSlate
$157
Crypto News (CryptoNews.net)
CryptoSlate reports $351.6, Crypto News (CryptoNews.net) reports $157 (55% apart).
amount taken
$24 million AFX
CryptoSlate
$71 million
Crypto News (CryptoNews.net)
CryptoSlate reports $24 million AFX, Crypto News (CryptoNews.net) reports $71 million (66% apart).
amount taken
$71 million
Crypto News (CryptoNews.net)
$83 million
CoinDesk
Crypto News (CryptoNews.net) reports $71 million, CoinDesk reports $83 million (14% apart).
Key facts
Bitget disclosed a breach that moved about $351.6 million from its hot and warm wallets on September 24, 2026.
351,600,000 USDDisputed figureReported by The Crypto Basic
Lookonchain's breakdown identified 102.93 million XRP worth $157.48 million as the largest component of the stolen assets.
102,930,000 XRPDisputed figureReported by The Crypto Basic
Bitget CEO Gracy Chen said the exchange detected the unauthorized transfers at 18:31 UTC and suspended withdrawals while leaving deposits and trading open.
Reported by The Crypto Basic
Gracy Chen said cold wallets were not compromised, private keys were not stolen and user funds are safe.
Reported by CoinGape
The XRP Ledger shows two Bitget wallets sending a combined 102,976,680 XRP to a single new address in three payments on September 24.
102,976,680 XRPDisputed figureReported by Bitcoin.com News
Bitcoin.com reported that only about 400,000 XRP, roughly 0.4% of the haul, had left the attacker's wallets by September 25.
400,000 XRPDisputed figureReported by Bitcoin.com News
Bitget said the attack matched techniques used by known North Korean hacking groups and reported the incident to authorities, hiring Mandiant and SlowMist to investigate.
Reported by CryptoSlate
Bitget's User Protection Fund, which held more than $464 million, covers the full amount of the loss.
464,000,000 USDDisputed figureReported by CoinGape
What happened
Bitget disclosed a security breach on September 24, 2026 in which attackers breached a backend wallet system, spoofed transfer data and triggered the exchange's normal signing process, moving roughly $351.6 million out of its hot and warm wallets. CEO Gracy Chen said Bitget detected the unauthorized transfers at 18:31 UTC, suspended withdrawals while leaving deposits and trading open, and found that cold wallets and private keys were not compromised. Lookonchain's breakdown put 102.93 million XRP worth $157.48 million as the largest single asset taken, ahead of about 31,890 ETH and roughly $75 million in stablecoins, while CoinDesk later put the total breach at $387.5 million. Bitget said analysis of IP activity and blockchain transactions showed the attack closely matched techniques used by known North Korean hacking groups, and onchain analyst Specter linked the stolen XRP to funds taken in July's $24 million AFX hack, attributed to the TraderTraitor cluster; CryptoSlate noted the attribution is unconfirmed and not yet independently verified by Bitget's outside security firms, Mandiant and SlowMist. On the XRP Ledger, three transfers from two Bitget wallets sent a combined 102,976,680 XRP to one new address, which Bitcoin.com reported had stayed largely untouched, with only about 400,000 XRP out of the attacker's wallets by Sept. 25, while CoinDesk found about $83 million of the XRP moved by 12:41 UTC Saturday, leaving roughly $75 million in accounts that cannot be frozen. The dollar figures differ between outlets, and Bitget's itemized asset total runs about $5.26 million above its initial estimate, which neither the security notice nor the breakdown explained. Bitget's User Protection Fund, which held more than $464 million, covers the loss, and the exchange scheduled withdrawals to reopen in stages from Sept. 28 through Oct. 2, with XRP absent from the earlier phases and placed in the final group by exclusion; Circle and Tether have frozen about $320,000 in related stablecoins. How much of the stolen XRP reaches an exchange, and whether any of it can be recovered, is not yet known.
How the story developed
- Update
Bitget discloses the wallet breach and suspends withdrawals
CEO Gracy Chen said the exchange detected unauthorized transfers at 18:31 UTC on September 24 and activated emergency response protocols.
- First report
First report by The Crypto Basic
XRP Tops List of Crypto Assets Taken in Bitget Hack
- Update
Lookonchain itemizes the stolen assets
The breakdown put 102.93 million XRP worth $157.48 million at the top of a nine-asset list totalling about $5.26 million above Bitget's estimate.
- Independent corroboration
Independently corroborated by CoinGape
Over $157M in XRP Stolen in Bitget Hack, North Korea’s Lazarus Group Suspected
- Official statement
Official statement from Bitcoin.com News
Bitget Hack: $157M in Stolen XRP Sits in Wallets No One Can Freeze
- Official statement
Bitget points to North Korean methods and hires Mandiant and SlowMist
Bitget said IP and transaction analysis matched known North Korean groups and that the incident was reported to authorities.
- Update
XRP Ledger records show three transfers to one new address
Transfers of 2,248,871 XRP, 91,420,943 XRP and 9,306,866 XRP left two labelled Bitget wallets for a single new address.
- Official statement
Bitget's protection fund is committed and withdrawals stay shut
The fund held more than $464 million and covers the loss, and the exchange set a staged reopening of withdrawals from Sept. 28 to Oct. 2.
- Update
Tens of millions of stolen XRP move between wallets
CoinDesk tracked about $83 million moved from three holding wallets by 12:41 UTC Saturday, and Bitquery measured 27.63 million XRP moving onward from two accounts by 02:54 UTC Sept. 26.
How coverage built up
Independent sources over time, counted the way the consensus panel counts them: a republication of a wire story does not move the line.
- 25 Sept 2026, 04:22 UTC: The Crypto Basic — 1 independent source, 1 reports
- 25 Sept 2026, 04:29 UTC: CoinGape — 2 independent sources, 2 reports
- 25 Sept 2026, 07:45 UTC: Bitcoin.com News, official — 3 independent sources, 4 reports
- 25 Sept 2026, 09:50 UTC: CryptoSlate — 4 independent sources, 5 reports
- 25 Sept 2026, 10:51 UTC: Finbold — 5 independent sources, 6 reports
- 26 Sept 2026, 06:25 UTC: Bitcoin Insider — 6 independent sources, 9 reports
- 26 Sept 2026, 12:56 UTC: CoinDesk — 7 independent sources, 10 reports
Affected entities
Also mentioned: Ripple, USD Coin, Avalanche, TRON, Circle, Arbitrum, Binance
Original sources
Related events
Bitget Says Protection Fund Covers $351.6 Million Lost in Exchange Wallet Drain
Crypto left five Bitget wallets across seven chains on Sept. 24, customers lost withdrawal access, and the exchange says its protection fund covers an estimated $351.6 million loss.
Bitget resumes bitcoin withdrawals four days after $387.5 million breach
Bitget reopened bitcoin withdrawals at 08:00 UTC on Sep. 28 after a Sep. 24 breach that moved about $387.5 million to attacker-controlled addresses.
NEAR Intents Blocked $50M of Bitget Theft, Then Lost $3.8M to Omni Bug
NEAR Intents blocked over $50 million in Bitget-hack transfers, then two days later lost about $3.8 million to a bug in its Omni deposit layer.
Duelbits Confirms About $7M Hot Wallet Drain Across Four Blockchains, Site Offline
Duelbits confirmed a roughly $7M hot wallet hack on Thursday, pulled its site offline and says user funds are safe while blockchain trackers dispute the amount stolen.
Binance Wallet Adds USDT Gas Payments on BNB Chain, Ethereum, Solana and TRON
Binance Wallet now lets users pay gas fees in USDT on BNB Smart Chain, Ethereum, Solana and TRON instead of holding each chain's native token.
BNB Chain becomes first chain to pass $1 billion in tokenized stocks and ETFs
Tokenized stocks and ETFs on BNB Chain hit $1.1 billion, about 30% of a $3.7 billion global market, making BNB Chain the first chain above $1 billion.