In early 2024, the cryptocurrency exchange Bitget suffered a major security breach that resulted in the theft of approximately $83 million worth of XRP, the digital asset issued by Ripple. The perpetrator, often referred to in industry reports as the "Bitget hacker," demonstrated a sophisticated understanding of both blockchain mechanics and the internal controls of the exchange, managing to move the stolen funds in a way that placed them beyond the immediate reach of standard freeze or seizure procedures. The attack unfolded in several stages.
First, the attacker gained unauthorized access to a set of privileged accounts that were used to manage the exchange’s cold storage wallets. These wallets are typically offline, designed to protect large balances from online threats. However, the hacker was able to bypass multi‑factor authentication safeguards, likely through a combination of phishing, social engineering, and exploiting a previously undisclosed vulnerability in Bitget’s internal API. Once inside, the hacker targeted five primary holding accounts that collectively stored the bulk of Bitget’s XRP reserves.
The initial movement involved draining two of these wallets almost completely. Transaction logs on the XRP ledger show a rapid succession of outgoing payments, each just below the threshold that would normally trigger an automated freeze or alert within the exchange’s monitoring system.
By keeping each transfer under the radar, the attacker avoided triggering the exchange’s internal risk controls. A third wallet is currently being emptied at a slower pace. Analysts monitoring the blockchain have observed a pattern of small, staggered withdrawals that suggest the hacker is either testing the waters for liquidity or attempting to avoid drawing attention from large‑scale market observers.
The remaining two wallets have not yet been touched, but together they still hold roughly $75 million in XRP. This residual balance represents the portion of the original $83 million that remains under Bitget’s control, albeit under heightened security scrutiny. What makes this theft particularly concerning is the method used to move the stolen XRP beyond the reach of conventional freeze controls.
After the initial withdrawals, the hacker employed a series of “gateway” addresses—intermediate wallets that act as bridges between the exchange’s accounts and the broader XRP ecosystem. By routing the stolen funds through multiple jurisdictions and converting a portion of the XRP into other assets via decentralized exchanges, the attacker created a complex web of transactions that would be difficult for any single authority to unwind. In the XRP ledger, unlike some other blockchains, there is no built‑in mechanism for freezing assets once they have been transferred. This characteristic is both a strength and a weakness: it ensures the network remains censorship‑resistant, but it also means that once illicit funds are on the chain, they can only be recovered through cooperation with custodians or by tracking and seizing the downstream assets.
The hacker’s use of “trust line” manipulations—establishing new trust lines with obscure issuers and then moving the XRP into those lines—further obscured the trail. The broader cryptocurrency community has responded with a mixture of alarm and calls for stronger custodial standards.
Security experts point out that the Bitget incident underscores the importance of hardware security modules (HSMs), air‑gapped storage, and rigorous access‑control policies. Some have suggested that exchanges adopt a “multi‑signature” approach for high‑value withdrawals, requiring multiple independent approvals before any large transfer can be executed.
Regulatory bodies are also taking note. In several jurisdictions, financial watchdogs have begun to examine whether existing anti‑money‑laundering (AML) frameworks are sufficient to address the rapid movement of stolen digital assets across borders.
The U.S. Treasury’s Office of Foreign Assets Control (OFAC) has issued an advisory reminding exchanges to monitor for suspicious activity involving large XRP transfers, especially those that appear to be structured to avoid detection. Bitget itself has issued a public statement acknowledging the breach, pledging to cooperate with law‑enforcement agencies, and promising to reimburse affected users from its insurance fund. The exchange has also announced an immediate freeze on all outgoing XRP transactions while it conducts a forensic review of its security architecture.
In addition, Bitget is working with third‑party blockchain analytics firms to trace the stolen funds, hoping to identify any points where the assets might be converted into fiat or other cryptocurrencies. From a technical perspective, the incident offers several lessons for the broader crypto industry. First, the importance of real‑time monitoring cannot be overstated.
While Bitget’s internal alerts did eventually flag the abnormal activity, the attacker’s strategy of keeping each transaction just below alert thresholds delayed the response. Second, the use of layered address structures—moving funds through multiple intermediary wallets—demonstrates how attackers can exploit the transparency of public ledgers to their advantage, creating a “mixing” effect without relying on traditional mixers. Looking ahead, the recovery of the stolen XRP remains uncertain.
Even if law‑enforcement agencies can identify the ultimate destination of the funds, the decentralized nature of the XRP ledger means that any seizure would require the cooperation of the custodians holding the final assets. In the meantime, the $75 million that still resides in the original five wallets is under intense scrutiny, and Bitget is expected to implement additional safeguards before allowing any further withdrawals.
The Bitget hack serves as a stark reminder that, despite advances in security technology, the human element—phishing, credential theft, and insider threats—continues to be a critical vulnerability for cryptocurrency platforms. As the industry matures, both exchanges and users will need to adopt a more holistic approach to security, combining robust technical controls with continuous education and vigilant oversight. In summary, the theft of $83 million in XRP from Bitget illustrates a sophisticated, multi‑phase attack that exploited both technical loopholes and operational oversights.
By draining two wallets nearly completely, siphoning a third, and leaving about $75 million across the remaining accounts, the hacker has forced the exchange and regulators to confront the challenges of asset recovery in a permissionless ledger environment. The incident is likely to influence future security standards, regulatory policies, and the overall approach to custodial risk management within the cryptocurrency ecosystem.