Key Takeaways
- Two Bitget wallets sent 102,926,478 XRP to a single new address in three payments on Sept. 24.
- Only about 400,000 XRP, roughly 0.4% of the haul, had left the attacker’s wallets by Sept. 25.
- Onchain analyst Specter has tied the XRP trail to July’s $24M AFX hack, hinting at North Korea’s Lazarus Group.
Three Payments, One Address
Bitget said attackers broke into “a critical backend system” inside its wallet infrastructure, spoofed transaction data and pushed over $350 million out of its hot and warm wallets. The biggest single slice was XRP and onchain trackers counted 102.93 million XRP worth $157.48 million, well ahead of the 31,890 ETH and roughly $75 million in stablecoins that also left.
The XRP Ledger (XRPL) shows exactly how it happened:
Adding them up comes to 102,976,680 XRP, the exact number one watcher flagged that night.
Lastly, it bears mentioning that the attacker has split the pile into four wallets holding 20 million XRP each and a fifth holding 22,976,677 XRP. Each hop drew a follow-up payment of 0.00001 XRP from unrelated addresses, a spam pattern typical of address poisoning, where scammers hope someone copies the wrong wallet.
The Freeze That Can’t Happen
Bitget CEO Gracy Chen said the exchange has contacted foundations on every affected chain and that a few have “already frozen the hacker’s wallet addresses.” That works for tokens with an issuer behind them, such as USDT or USDC. It has worked on other networks too; i.e. Arbitrum froze $71 million tied to the KelpDAO exploit in April.
XRP, however, is a different animal given that no one can freeze the asset once part of the ledger. The XRPL’s freeze tools apply only to issued tokens, not to the native asset. That means the largest chunk of the Bitget haul is the one piece no foundation can touch. The only chokepoints left are the exchanges and bridges the attacker has to pass through to cash out.
The Thread Back to July And a Possible Lazarus Connection
Chen said IP behavioral patterns and onchain signatures are “consistent with techniques used by DPRK-linked hacker groups,” while stressing the attacker’s identity isn’t confirmed. Onchain analyst Specter went further, posting a flow graph that connects ETH paid out by the Bridgers swap service for stolen XRP to wallets tagged with the Trader Traitor cluster. Specter links those funds to the AFX attack in July, a roughly $24 million theft.
The connection is still thin since the graph runs through a single Ethereum wallet holding about $4,300, and small overlaps like that can simply reflect shared laundering services. Still, the pattern fits and security firm Blockaid attributed roughly $609 million of first-half 2026 losses to the Trader Traitor cluster, which is tied to the Lazarus Group.
A $157 Million Overhang
So far, the cash-out has been a trickle and onchain sleuth Yfarmx spotted 33,500 XRP moving through Bridgers on Sept. 25 and called it “a test run before a bigger cash-out.” The ledger now shows about 400,105 XRP gone from one of the five wallets, while the other four haven’t moved a single coin.
XRP is trading at $1.53 today, up 1.4% since yesterday, so the market has shrugged the development for now. That could change quickly if tens of millions of XRP start hitting swap desks. The mood was already fragile, and Bitcoin.com News reported recently that the average long-term XRP trader is still down 11.75% even after XRP’s recent rebound.
Bitget says its User Protection Fund will cover the loss after assessment. That fund currently holds 5,500 BTC.
