Bitget Hack Leaves $157 Million in XRP Stuck in Unfreezeable Wallets

On Sept. 24, attackers breached Bitget’s wallet infrastructure and moved 102,926,478 XRP – worth roughly $157 million – to a single fresh address in three separate payments. The bulk of the stolen XRP is now split across five wallets that the XRP Ledger cannot lock, leaving the funds effectively untouchable until they are moved through an exchange or bridge.

How the Theft Unfolded

Bitget said the hackers accessed a “critical backend system,” spoofed transaction data and drained over $350 million from hot and warm wallets. The XRP transfers were recorded as follows:

• 19:01 UTC – 2,248,871 XRP sent to a new address beginning with rwNhefsz
• 19:16 UTC – 91,420,943 XRP sent to the same address
• 19:30 UTC – 9,306,866 XRP sent to the same address

The three payments total 102,976,680 XRP, matching on‑chain monitoring alerts.

Where the Funds Are Now

The attacker divided the haul into four wallets holding roughly 20 million XRP each and a fifth holding 22,976,677 XRP. As of Sept. 25, only about 400,000 XRP (≈0.4 % of the total) had left these wallets, moving through the Bridgers swap service.

Why the XRP Can’t Be Frozen

Unlike issued tokens such as USDT or USDC, the native XRP asset on the XRP Ledger lacks a freeze mechanism. Foundations can freeze issued tokens, but they have no control over the native ledger entry. Consequently, the largest portion of the theft remains beyond direct intervention, and the only practical chokepoints are the exchanges and bridges the attacker must use to cash out.

Possible Links to Previous Hacks

On‑chain analyst Specter noted similarities between the XRP trail and the July 2026 $24 million AFX hack, suggesting techniques consistent with the DPRK‑linked Lazarus Group. The connection is based on a single Ethereum wallet used for a small ETH payout, and security firm Blockaid has linked the broader “Trader Traitor” cluster to Lazarus‑related activity.

Impact and Response

Bitget’s CEO Gracy Chen confirmed that the exchange has contacted relevant foundations and that some chains have frozen related addresses where possible. The exchange’s User Protection Fund, currently holding 5,500 BTC, will cover assessed losses. XRP’s price has risen modestly since the incident, but market sentiment could shift if large volumes are liquidated.