Bitget's stolen XRP cannot be frozen as most of haul sits idle
More than 99% of the 102.97 million XRP taken from Bitget on 24 September remained in attacker wallets a day later, and the XRP Ledger offers no way to freeze the native asset.
Key points
- Bitget detected unauthorised transfers from hot wallets at 18:31 UTC on 24 September and paused withdrawals.
- Two Bitget wallets sent 102,976,680 XRP to a new address in three payments, split into four wallets of 20 million XRP and one of 22,976,677 XRP.
- Only about 400,105 XRP, roughly 0.4% of the haul, had moved by 25 September.
- Bitget put the total value moved at more than $350 million, with the XRP portion worth $157.48 million.
- CEO Gracy Chen said IP patterns and onchain signatures are consistent with DPRK-linked techniques, though identity is unconfirmed.
Bitget's attackers have barely touched the largest part of their haul. More than 99% of the 102.97 million XRP drained from the exchange on 24 September was still sitting in five freshly created wallets a day later, according to News.bitcoin, and the XRP Ledger offers no mechanism to lock it down.
Bitget first acknowledged the incident in a Thursday post from chief executive Gracy Chen, whose exchange is based in Victoria, Seychelles. Bitcoinmagazine reported that Bitget detected unauthorised transfers from some hot wallets at 18:31 UTC on 24 September and immediately paused withdrawals while a security review runs. The exchange processes more than $1.1 billion in daily trading volume, making it the sixth largest platform on that measure.
Two Bitget wallets sent 102,976,680 XRP to a single new address beginning rwNhefsz in three payments on 24 September: 2,248,871 XRP at 19:01 UTC, then 91,420,943 XRP fifteen minutes later, then 9,306,866 XRP. The attacker split the pile into four wallets of 20 million XRP each and a fifth holding 22,976,677 XRP. Only about 400,105 XRP, roughly 0.4% of the haul, had left those wallets by 25 September, and the other four had not moved a coin.
Stolen XRP sits idle
Bitget said the breach hit a critical backend system in its wallet infrastructure. Chen said the three-tier wallet architecture contained the damage to the hot and warm layers, and that cold wallets stayed secure. Bitcoinmagazine reported that Hacken later said bitcoin had also been moved, a detail not on Arkham's initial dashboard, while Chen said deposits and trading remained operational.
Chen said the exchange has contacted foundations on every affected chain and that a few have already frozen the hacker's wallet addresses. That approach works for tokens with an issuer behind them, such as USDT or USDC, and has worked elsewhere: Arbitrum froze $71 million tied to the KelpDAO exploit in April, News.bitcoin noted. XRP is a different case, because the XRPL's freeze tools apply only to issued tokens, not the native asset.
Bitget put the total value moved at more than $350 million, a figure Bitcoinmagazine rounded to $351.6 million. The XRP portion accounted for $157.48 million, ahead of 31,890 ETH and roughly $75 million in stablecoins. That leaves exchanges and bridges as the only chokepoints the attacker must pass through to convert the coins into cash. Onchain sleuth Yfarmx spotted 33,500 XRP moving through the Bridgers swap service on 25 September and described it as a test run before a bigger cash-out.
Freeze tools fall short
Chen said IP behavioural patterns and onchain signatures are consistent with techniques used by DPRK-linked hacker groups, while stressing the attacker's identity is not confirmed. Analyst Specter posted a flow graph connecting ETH paid out by Bridgers for stolen XRP to wallets tagged with the Trader Traitor cluster, which Specter links to July's AFX attack, a theft of roughly $24 million. News.bitcoin cautioned that the connection is thin, running through a single Ethereum wallet holding about $4,300. Bitget says its User Protection Fund, holding 5,500 BTC, will cover the loss after assessment.