In a dramatic episode that has sent shockwaves through the cryptocurrency community, the digital asset exchange Bitget has found itself at the center of a massive theft involving approximately $83 million worth of XRP. The incident, which appears to be the work of a sophisticated hacker or hacking group, has highlighted the challenges that even well‑established platforms face when trying to protect digital assets from determined adversaries. According to the latest reports, the attacker managed to move the stolen XRP out of the exchange’s custody and into a series of external wallets that were previously unknown to Bitget’s security team.
The initial breach involved five primary holding accounts that were used by the exchange to store large quantities of XRP for its users. Over the course of the attack, two of those wallets were almost completely emptied, while a third is still in the process of being drained. At the time of reporting, roughly $75 million in XRP remains distributed across the five original accounts, meaning that a substantial portion of the stolen funds has already been transferred away from the exchange’s direct control.
What makes this case particularly concerning is the fact that the stolen XRP appears to have been moved beyond the reach of Bitget’s freeze controls. Many exchanges implement mechanisms that can temporarily lock or freeze assets on their internal ledgers in an attempt to halt unauthorized transfers. However, once the crypto leaves the exchange’s internal system and is transferred to external blockchain addresses, those freeze tools become ineffective.
In this instance, the hacker succeeded in routing the XRP through a series of transactions that effectively placed the funds outside the jurisdiction of Bitget’s on‑chain controls, rendering the exchange unable to stop the outflow. The timeline of the breach suggests a high level of planning and technical expertise.
Security analysts believe that the attacker likely exploited a vulnerability in Bitget’s withdrawal process—potentially a flaw in multi‑signature verification, API authentication, or an insider‑related lapse. By gaining access to the private keys or credentials needed to authorize large withdrawals, the hacker was able to initiate a cascade of transfers that quickly moved the assets to a series of wallets under their control. The use of multiple wallets is a common tactic among crypto thieves, as it helps to obscure the trail and make it more difficult for investigators to trace the final destination of the stolen funds.
In the aftermath of the incident, Bitget has issued a statement acknowledging the breach and assuring its users that it is working closely with law‑enforcement agencies and blockchain forensic firms to track the stolen XRP. The exchange emphasized that it has already taken steps to strengthen its security posture, including a comprehensive review of its withdrawal protocols, the implementation of stricter multi‑factor authentication requirements, and an upgrade to its internal monitoring systems to detect anomalous activity more rapidly.
The broader crypto industry is watching the situation closely, as the theft underscores a persistent vulnerability: once digital assets are transferred to an external address, they become virtually impossible to recover without the cooperation of the holder of the private keys. This reality has spurred ongoing discussions about the need for more robust custodial solutions, insurance mechanisms, and perhaps even regulatory frameworks that could compel exchanges to maintain higher standards of security and transparency. For users of Bitget and other exchanges, the incident serves as a stark reminder to adopt best practices for personal security. These include enabling hardware‑based two‑factor authentication, regularly reviewing account activity, and, where possible, storing large holdings in cold wallets—offline storage solutions that are not directly connected to the internet and therefore less susceptible to remote hacking attempts.
From a technical perspective, the theft also highlights the importance of blockchain analytics in modern cyber‑crime investigations. Companies specializing in chain‑analysis have the capability to follow the movement of stolen tokens across the ledger, identify clustering patterns, and sometimes even pinpoint exchange addresses where the illicit funds may eventually be laundered.
While the XRP network is known for its speed and low transaction costs, these same attributes can be exploited by malicious actors to quickly disperse stolen assets before investigators can intervene. In summary, the Bitget hack represents one of the most significant XRP thefts to date, with roughly $83 million in digital currency being siphoned away from the exchange’s custody.
Two of the five primary wallets have been nearly emptied, a third continues to be drained, and about $75 million remains across the original accounts. The attacker succeeded in moving the funds beyond the reach of Bitget’s internal freeze controls, illustrating the limitations of on‑chain security measures once assets leave an exchange’s controlled environment. Bitget has pledged to cooperate with authorities and to bolster its security infrastructure, while the incident serves as a cautionary tale for the entire crypto ecosystem about the ever‑present risk of large‑scale thefts and the need for continuous vigilance.