Crypto25 September, 20262 min read
Bitget Says Hacker Moved $83 Million In Stolen XRP After Freeze Failed
This article is an automated aggregation of coverage from news outlets. Our editorials offer in-depth analysis curated by the NewsCord team.
Bitget hack affected about $351.6 million, later estimated at $387.5 million. Bitget attacker moved roughly $83 million of XRP; Ripple cannot freeze XRP.
25 outlets told this the same way.
Bitget hack, funds move
Bitget said its analysis estimates that assets worth approximately $387.5 million were affected in the breach, and the exchange planned to announce its withdrawal resumption schedule by 1 p.m. on the 26th. Bitget CEO Gracy Chen said the hacker compromised a backend system and activated Bitget’s authorization process to move the funds.
“Our analysis estimates that assets worth approximately $387.5 million were affected.”
Lookonchain reported that wallet 0x4885 withdrew 257.6 ETH and 545,000 USDT from Binance, swapped the USDT for another 200.2 ETH, and then sent all 457.9 ETH, totaling roughly $1.23 million, to a Bitget-hacker address. Bitget said its protection fund can cover the damage, leaving customer assets unaffected, and it scheduled withdrawals to resume in stages starting with Bitcoin (BTC) on September 28.
XRP cannot be frozen
Ripple said it cannot freeze or forcibly move the XRP held in the hacker’s wallet because XRP is the network’s native asset. CoinDesk reported that the hacker behind Bitget’s $387.5 million breach moved about $83 million in stolen XRP out of three holding wallets, while roughly $75 million remains in accounts that cannot be frozen under the XRP Ledger’s rules.
CoinDesk said the XRP Ledger lets companies freeze tokens they issue on it, but that power does not extend to XRP itself, and Ripple has no built-in way to block the attacker from spending those coins. CoinDesk also reported that Circle and Tether have already frozen about $320,000 in stablecoins connected to the breach, while native XRP remained outside issuer freeze controls.
North Korea suspicion, next
Bitget CEO Gracy Chen said investigators identified internet protocol addresses linked to VPN services previously used by a North Korean hacking group, and she said the attack pattern resembled earlier operations attributed to the country. Chen told reporters that private key compromise has been ruled out, and she said withdrawals remain suspended while technical teams repair and reinforce the affected systems.
“The company must announce the schedule to resume withdrawals no later than September 26.”
Bybit CEO Ben Zhou said his team was standing by to assist Bitget, which supported Bybit following its $1.5 billion hack in February 2025. Bitget said it planned to resume withdrawals in stages up to October 2, with Ethereum (ETH) on September 29 and Tether (USDT) on September 30, as the exchange continued working to track the stolen funds.