Bitget says unauthorized transfers affected approximately $351.6 million in crypto assets after attackers accessed part of the exchange’s hot and warm wallet infrastructure.
XRP accounted for the largest share, according to the on-chain tracker Lookonchain, followed by Ether (ETH), as Bitget suspended withdrawals and began a security review.
The exchange detected the transfers at 18:31 UTC on Sept. 24 and activated its emergency response procedures within minutes.
Bitget says its cold wallets remain secure and that the incident was contained to portions of its online wallet systems. Deposits and regular trading remain available, but withdrawals have no confirmed reopening time.
XRP Accounts for the Largest Reported Loss
Lookonchain identified 102.93 million XRP, valued at approximately $157.5 million, among the assets taken. It also listed 31,890 ETH worth about $85.8 million. Together, those two holdings represent more than $243 million at the tracker’s reported valuations.
The remaining assets in Lookonchain’s breakdown include $34.8 million in USDT, $21.1 million in USDC and $19.7 million in USD₮0.
It also identified tokenized gold, BNB, AVAX, and TRX. The tracker’s itemized values total roughly $356.9 million, about $5.3 million above Bitget’s initial estimate. Neither figure should be treated as final while the investigation and asset tracing continue.
The distinction between the XRP and ETH figures matters. The 31,890 ETH represents Ether identified among the affected assets.
Separately, trackers reported that the attacker swapped proceeds from assets on Ethereum-compatible networks into ETH. Those swaps do not show that the attacker sold all the stolen XRP for Ether.
Early alerts captured only part of the activity. Before Bitget disclosed its $351.6 million estimate, monitoring accounts had flagged more than $170 million in suspicious transfers from exchange-linked wallets, with later observations putting the visible movements above $180 million.
Bitget’s announcement expanded the reported scope of the incident considerably.
Bitget Says Cold Wallets and Its Separate Wallet Product Are Safe
In its initial notice, Bitget said the breach affected part of its hot and warm wallet layers. Those systems support more routine transfers than offline cold storage.
The company said all cold wallets were secure and that customers’ account balances remained accurate. Its assurances about the extent of the compromise await the promised incident report.
Chief Executive Gracy Chen subsequently said the affected assets spanned multiple chains, including Ethereum, XRP Ledger, Arbitrum, Avalanche, Optimism, BNB Smart Chain and Base.
She identified XRP Ledger as the largest source of losses on a single chain. Bitget also said its separate, non-custodial Bitget Wallet product was unaffected.
The exchange has flagged addresses associated with the transfers and notified law enforcement and on-chain security firms.
Chen said the company had contacted organizations associated with the affected blockchains to restrict the movement of stolen assets. The full recovery prospects remain unclear.
Bitget says its User Protection Fund holds more than $464 million and can cover the estimated $351.6 million loss.
That is a statement about the fund’s reported capacity; it does not mean the stolen assets have been recovered or that withdrawals have resumed. The exchange has said it will restore withdrawals after its security review, without committing to a time.
Investigation Focuses on How Transfers Were Authorized
Bitget initially declined to speculate on the attack vector. Chen later described preliminary findings indicating that an attacker compromised a backend system connected to the exchange’s wallet infrastructure and submitted fraudulent transfer data through its authorization process.
She said investigators had ruled out the theft of private keys, although Bitget has yet to publish the full technical account it promised.
Chen also raised a possible resemblance to methods used by North Korean hacking groups. That remains a preliminary lead, not an established attribution.
The exchange has said it is cooperating with investigators and will publish a report covering the cause of the breach and its corrective measures.
For Bitget users, the immediate question is when withdrawals will return.
Investigators still need to determine the final loss, how the attacker accessed the backend system, and how much of the XRP, ETH, and other assets they can trace or recover.
