In a dramatic turn of events that has sent shockwaves through the cryptocurrency community, a hacker who breached the Bitget exchange has successfully moved an estimated $83 million worth of XRP beyond the reach of the platform’s freeze controls. The illicit operation appears to have been meticulously planned, targeting multiple wallets associated with the exchange’s internal holdings. According to investigators, two of the compromised wallets were almost completely emptied, while a third is still in the process of being drained.
After the initial wave of theft, roughly $75 million remains spread across five original accounts that were once under Bitget’s direct control. The breach was first detected when Bitget’s security team noticed abnormal transaction patterns emanating from several of its cold storage addresses. These addresses, typically used to safeguard large quantities of digital assets, are designed with multiple layers of protection, including multi‑signature requirements and time‑locked withdrawals. However, the attacker managed to circumvent these safeguards, likely by exploiting a combination of social engineering tactics and vulnerabilities in the exchange’s internal key management procedures.
Once the hacker gained access, the first priority was to move the stolen XRP to wallets that lay outside the jurisdiction of Bitget’s freeze capabilities. By routing the funds through a series of intermediary addresses—often referred to as “mixers” or “tumbling services”—the perpetrator effectively obscured the trail, making it exceedingly difficult for investigators to trace the final destination of the assets.
This method of laundering is common in high‑value crypto thefts, as it leverages the pseudonymous nature of blockchain transactions while adding layers of complexity that can thwart conventional forensic analysis. The immediate impact on Bitget’s balance sheet was substantial.
Two of the targeted wallets, which together held a combined value of approximately $30 million in XRP, were nearly emptied within a matter of hours. A third wallet, containing about $12 million, is still being siphoned, with the hacker’s activity continuing to be monitored in real time. The remaining five accounts, which originally housed the bulk of the exchange’s XRP reserves, now retain roughly $75 million, a figure that represents a significant reduction from the pre‑attack total.
Industry experts have weighed in on the broader implications of the incident. "This breach underscores the evolving threat landscape for centralized crypto platforms," said Dr.
Elena Morales, a blockchain security analyst at CipherGuard. "Even exchanges that employ sophisticated multi‑sig and cold‑storage strategies are not immune to coordinated attacks that combine technical exploits with human error." Regulatory bodies are also taking note.
The incident has prompted inquiries from financial watchdogs in several jurisdictions, all of which are keen to understand how a single point of failure could result in the loss of such a massive sum. In particular, the U.S. Securities and Exchange Commission (SEC) and the Financial Conduct Authority (FCA) in the United Kingdom have requested detailed reports from Bitget regarding its internal controls, risk management policies, and the steps being taken to remediate the breach.
Bitget’s leadership has issued a public statement acknowledging the theft and pledging to cooperate fully with law enforcement agencies worldwide. "We are deeply sorry for the distress this incident has caused our users and partners," the statement read. "Our top priority is to secure the remaining assets, investigate the root cause of the breach, and implement enhanced security measures to prevent future incidents." In response to the attack, the exchange has already taken several immediate actions. All outbound withdrawals of XRP have been temporarily halted, and a comprehensive audit of the affected wallets is underway.
Bitget is also working with leading cybersecurity firms to conduct a forensic analysis of the breach, aiming to identify any backdoors, compromised credentials, or malicious code that may have been introduced into their systems. For users who hold XRP on the Bitget platform, the incident raises important questions about asset safety and the role of custodial services. While centralized exchanges offer convenience and liquidity, they also introduce a single point of failure that can be exploited by sophisticated actors.
This event serves as a reminder for investors to consider diversifying storage solutions, such as employing hardware wallets or other non‑custodial methods, to mitigate the risk of loss due to exchange hacks. The broader crypto community has also rallied around the issue, with several prominent figures calling for industry‑wide standards on security best practices. Proposals include mandatory third‑party security audits, real‑time monitoring of large wallet movements, and the adoption of advanced cryptographic techniques like threshold signatures to further decentralize control over high‑value assets. As the investigation unfolds, law enforcement agencies are employing blockchain tracing tools to follow the flow of the stolen XRP.
While the anonymity of blockchain transactions presents challenges, the transparency of the ledger allows analysts to map out transaction pathways, identify clustering patterns, and potentially pinpoint exchanges or services where the illicit funds may eventually surface. In summary, the Bitget hack represents one of the most significant XRP thefts to date, with $83 million in digital assets being moved beyond the exchange’s immediate control. The incident highlights the persistent vulnerabilities that even well‑funded, technically sophisticated platforms face, and it underscores the importance of robust security architectures, continuous monitoring, and user education. As the crypto ecosystem continues to mature, stakeholders across the board—exchanges, regulators, and investors alike—must collaborate to fortify defenses and safeguard the integrity of digital finance.