Major exchange hack drains $157M XRP

TLDR

Hackers stole about 103 million XRP (around $157 million) from Bitget in a large exchange hot-wallet breach, but most of the XRP remains unsold and XRPs price has stayed surprisingly resilient.

1. Bitget reported a multi-chain security breach of roughly $351.6387.5 million, with around 102.9 million XRP (about $157 million) making up the single largest chunk of the haul.
2. The stolen XRP sits mostly in a small set of external wallets and cannot be frozen at the protocol level, creating a supply overhang even as ETF inflows and whale buying have supported XRPs price.
3. Bitget has paused withdrawals and says its $464 million User Protection Fund will cover all user losses, while investigators track the attacker wallets and probe a possible North Korean link.

Deep Dive

1. What Was Stolen

Bitget disclosed a security breach on 24 September that hit its hot and warm wallet infrastructure, with total losses initially estimated at about $351.6 million and later revised closer to $387.5 million in crypto assets. Reports say roughly 102.9 million XRP, worth around $157 million at the time, was drained from Bitget and represented about 44% of the total theft, far more than any other asset, including about 31,900 ETH and tens of millions in USDT and USDC.

Analysis from outlets such as Finbold and Yahoo Finance notes that the attack appears to have exploited a backend wallet system, allowing hackers to send spoofed transaction data that Bitgets automated approval logic signed as if they were normal withdrawals. Bitget states that cold wallets remained intact and only internet-connected hot and warm wallets were affected, which fits the pattern seen in many prior centralized-exchange hacks.

2. XRP Price And Supply

Despite the theft, XRP (XRP) has traded higher over the past week, with multiple reports highlighting a roughly mid-teens percentage gain and a rebound to the mid-$1 range after the incident. Coverage notes that United States spot XRP ETFs have seen steady inflows and that large holders accumulated hundreds of millions of XRP in the days around the hack, which helped absorb selling pressure.

On-chain tracking shows more than 99% of the roughly 103 million stolen XRP still parked in five fresh wallets, with only a few hundred thousand XRP moved so far. Because XRP is a native coin on the XRP Ledger, there is no issuer with a general freeze power over XRP itself, unlike some centralized stablecoins, so those coins cannot simply be clawed back. The overhang risk is that, if the attacker starts dumping significant size into the market, it could briefly overwhelm ETF and whale demand and pressure price.

3. User Safety And Next Steps

Bitget says customer account balances are fully covered by its User Protection Fund, which reportedly holds over $464 million, and that user losses will be reimbursed even though withdrawals remain paused while the investigation continues. The exchange has launched a bounty program for information or assistance that leads to freezing or recovery of stolen assets, and has brought in external security firms to help.

Investigators and Bitget have flagged overlap between some attacker IPs and prior operations linked to North Korean groups such as Lazarus, although attribution remains unconfirmed and no public technical proof definitively ties this incident to a specific actor yet. For users, the practical risk is less about the XRP network and more about venue risk: concentration on a single exchange, reliance on hot wallets, and withdrawal pause risk during incidents.

Conclusion

A large portion of the Bitget hacks dollar value came from XRP, but the incident reflects exchange security and custody design, not a flaw in XRPs protocol. Market demand via ETFs and large holders has so far offset the psychological shock, keeping XRP relatively resilient while the stolen stash sits mostly idle. Going forward, the key variables are how quickly Bitget restores normal operations and whether the attacker begins to move and sell those coins in size, which would directly test the markets ability to absorb a sudden supply shock.