Bitget Hot Wallet Breach Tests XRP and Ethereum Liquidity

AI

AI Summary

• Bitget said unauthorized transfers affected approximately $351.6 million and prompted a temporary withdrawal pause.
• The exchange said its user protection fund exceeds the estimated loss and that its cold wallet layer remained secure, although those claims await independent confirmation.
• A cited asset list included 102 million XRP, 31,000 Ethereum, 34 million USDT and 21 million USDC, but no primary onchain source URL was supplied.
• Gracie Chen described DPRK involvement as likely, while acknowledging that the precise attack method had not yet been established.

Crypto markets often reward attention to price momentum, but operational risk can overwhelm a bullish narrative without warning. Bitget said unauthorized transfers from parts of its wallet infrastructure affected approximately $351.6 million, prompting the exchange to suspend withdrawals while it conducted a security review. A cited asset breakdown put XRP and Ethereum among the principal reported exposures.

According to a company statement reproduced in the source material, Bitget detected the transfers at 18:31 UTC on September 24, 2026. The exchange said deposits and trading remained operational, account balances were accurate, and its cold wallet layer had not been compromised. Those are Bitget’s claims at this stage, not conclusions from an independent audit or a published forensic report.

Our analysis is that the immediate question is not whether the incident invalidates digital asset infrastructure. It is whether Bitget can substantiate its containment, coverage and attribution claims while restoring withdrawals safely. The quality of that evidence will matter more than promotional assurances or short term market forecasts.

IT'S MONEY MAKING SEASON!! Chainlink Federal Reserve!! QNT Clearing House! BitGet $351 Million Hack!

What Bitget says happened

Bitget described the event as a breach of its systems that enabled funds to be transferred directly from the exchange. Chief executive Gracie Chen gave a rounded estimate when addressing the incident:

Current estimated funds affected is about 350 million.

The accompanying statement supplied a more precise estimate of approximately $351.6 million. That difference appears to reflect rounding rather than two separate loss calculations, but the final amount remains subject to reconciliation. Bitget said its emergency team acted within minutes and that withdrawals were paused as a precaution.

• Detection: Bitget reported unauthorized transfers from a portion of its hot and warm wallet infrastructure.
• Containment: The exchange instituted a withdrawal pause while keeping deposits and trading operational.
• Escalation: Bitget said transfer addresses were flagged and reported, with law enforcement and onchain security firms engaged.
• Disclosure: The exchange promised continuing updates and a full incident report covering the root cause and corrective measures.

Why the wallet architecture matters

Bitget said it uses a three tier architecture spanning hot wallets, warm wallets and cold wallets. Hot infrastructure supports routine transaction processing, while progressively more isolated storage is intended to reduce the assets exposed to an online compromise. The presence of tiers does not prevent every breach; its value depends on access controls, transaction policies and whether a compromise can move laterally between systems.

The exchange claimed that only part of the hot and warm layers was affected and that the cold layer remained fully secured. Chen further distinguished the reported system breach from the theft of wallet private keys:

They did not forge user withdraw request nor did they obtain our private keys of the uh cold wallet and nor or or any hot warm wallet.

If confirmed, that distinction would narrow the investigation toward permissions, internal systems or transaction execution rather than direct extraction of wallet keys. It does not by itself establish the entry point, affected components or full duration of unauthorized access.

• Hot wallets: The reported source of at least some unauthorized transfers and therefore the immediate containment priority.
• Warm layer: Bitget said a portion was affected, but the supplied material did not quantify its separate exposure.
• Cold wallets: Bitget said this layer remained secure, a claim that should be tested against wallet records and the final forensic report.

The reported asset exposure

A third party asset list cited in the source material reported 102 million XRP, 31,000 Ethereum, 34 million USDT and 21 million USDC among the affected assets. No primary onchain report or address list was supplied, so these figures should be treated as attributed preliminary data rather than independently verified balances.

• XRP: 102 million units were reported in the cited list.
• Ethereum: 31,000 units were reported.
• USDT: 34 million units were reported.
• USDC: 21 million units were reported.

The source also named BNB, Avalanche and Tron, but its sequencing of the remaining figures was ambiguous. We are therefore not assigning those numbers to particular assets. The reported token quantities also cannot be compared directly without reliable valuation timestamps, wallet addresses and transaction records.

For XRP in particular, the reported quantity creates a potential liquidity question, but it does not prove that the assets have been sold. Movement from an exchange wallet, control by an attacker and successful conversion into other assets are separate stages with different evidentiary requirements.

DPRK attribution remains provisional

Chen said Bitget believed a North Korean group, potentially working with partners, was likely responsible. She linked that assessment to IP addresses that allegedly matched VPN choices associated with a particular DPRK group.

I think I answered this question earlier that we think it is mainly a uh North Korean group.

This is an initial attribution claim, not a demonstrated conclusion. IP addresses and VPN patterns can inform an investigation, but attribution normally requires corroboration across infrastructure, access logs, malware, wallet activity and operational methods. None of that underlying evidence was supplied with the transcript.

Chen also acknowledged that the exchange had not established precisely how the system was penetrated:

But exactly how they breached our system and what system I I don’t have further information yet.

That admission is material. Until Bitget identifies the affected system and publishes a defensible root cause, the DPRK assessment should remain explicitly provisional.

Market risk is not the same as immediate selling

The reported asset inventory creates possible selling pressure, especially where a large balance is concentrated in a liquid token. Yet a possible sale is not an executed sale. Flagged addresses, exchange screening, stablecoin controls and limited counterparties may complicate an attacker’s ability to convert or bridge funds. Conversely, sophisticated routing could distribute activity across multiple venues and assets.

Our view is that traders should separate three risks that are easily conflated:

• Exchange risk: Whether Bitget can meet withdrawal obligations and restore normal operations.
• Asset liquidity risk: Whether affected XRP, Ethereum or stablecoins reach markets in sufficient size to disrupt order books.
• Confidence risk: Whether uncertainty around controls causes users to reduce exposure before the investigation is complete.

None of these outcomes is predetermined by the headline loss estimate. Wallet monitoring and verified exchange disclosures are more useful than treating every transfer as an immediate market sale.

The protection fund now faces its practical test

Bitget said its user protection fund held more than $464 million and that the estimated loss fell within its coverage. On the figures presented, the stated fund is larger than the preliminary loss. That arithmetic is reassuring only if the fund’s assets are available, sufficiently liquid and not exposed to the same compromised controls.

The exchange also said customer balances were accurate and protected. A balance displayed in an account interface, however, is an internal liability record. The stronger evidence will be whether users can withdraw once the security review ends and whether Bitget demonstrates that remaining reserves and protection assets can satisfy obligations.

The incident therefore turns the protection fund from a marketing safeguard into an operational commitment. Clear wallet identification, evidence of fund deployment and transparent accounting would make that commitment measurable. Without those details, the claim remains a company assurance.

What this means

1. Containment must be demonstrated. The withdrawal pause can limit further movement while systems are reviewed, but restoration should follow evidence that the exploited route has been closed. Speed matters less than a safe and clearly documented reopening.

2. Coverage is more than a headline number. Bitget’s stated $464 million protection fund exceeds the preliminary $351.6 million estimate. Users still need clarity about the fund’s composition, custody and process for absorbing losses without impairing withdrawals.

3. Attribution should follow forensics. The reported VPN and IP overlap may support an investigative lead, but the unresolved attack vector means the North Korean attribution cannot yet substitute for a root cause analysis.

For exchange security, the decisive milestones are a verified scope, a disclosed remediation plan and reliable access to customer assets. Price reactions in XRP or Ethereum may occur before those milestones, but they should not be mistaken for forensic evidence.

Bigger picture

The incident arrives as financial institutions continue examining tokenized settlement and crosschain infrastructure. At a Federal Reserve fintech conference, the Chainlink founder described blockchains as increasingly inexpensive database infrastructure and presented CCIP as connectivity for traditional finance. His economic case was summarized by a simple question:

the real question is why wouldn’t they do it?

Lower transaction costs can strengthen the case for onchain finance, but lower costs do not remove custody, authorization and operational risks. Institutional adoption depends on controls around the networks as much as on the efficiency of the networks themselves.

That distinction also appears across related developments covered by AllinCrypto. Our analysis of ECB Pontes examined Stellar and Chainlink, while a separate report covered DTCC’s connection with Ondo Finance. We have also assessed the FedNow cross border plan and the SEC innovation exemption for onchain tokenized stock trading.

Those developments do not verify any Bitget claim. They show why custody and transaction controls are becoming more consequential as larger values move across digital infrastructure. In our view, adoption and security are not competing narratives. They are parts of the same institutional test.

Sources

This article is for informational purposes only and does not constitute financial advice.