Bitget Hack: Forged Transfers Siphon $357M as North Korea Eyed

Bitget's attackers did not break the cryptography that guards its wallets. They broke into a backend wallet system, forged transfer details and let the exchange's own authorised signing process approve roughly $357 million of outflows on Thursday, the company's preliminary finding says. Chief executive Gracy Chen put the odds of a North Korean link high, citing IP addresses that match VPN patterns tied to a DPRK-associated group, while stressing the attribution is not confirmed. XRP traded at $1.54 as of 02:00 UTC today, up 3.33% over 24 hours, on $4.49 billion of volume against a $96.81 billion market cap.

Context — why the Bitget hack matters beyond one exchange

The report itself supplies the yardstick Bitget wants applied. Chen compared her firm to Bybit, which survived a roughly $1.5 billion theft in February 2025 that has been blamed on North Korean state-linked hackers. Her argument is arithmetic: if Bybit's retail book could absorb a loss more than four times larger, Bitget's can absorb one of just over $300 million. That is the precedent, and it cuts both ways — it establishes that large exchange hacks are survivable, and it establishes that they keep happening.

The mechanics are what separates this incident from a classic key compromise. Bitget says leakage of private keys, the secret codes controlling a wallet, has been ruled out. Attackers instead forged transfer details inside the wallet system and triggered the normal authorised signing flow. The practical analogue is invoice fraud: nobody stole the boss's signature, someone edited the payment instructions and the company's own controls signed off.

That distinction matters for how the industry reads the breach. A key leak implies a cryptography failure and puts every wallet sharing that key architecture in question. A forged-instruction breach points at internal system controls, access management and review procedures — a narrower failure, but one that sits inside the exchange rather than outside it.

The macro backdrop is unforgiving for exchanges under stress. Digital-asset venues are judged on withdrawal reliability in hours, not quarters, and Bitget's withdrawals remained frozen while trading continued. Chen also rejected comparisons with FTX, the exchange that collapsed in 2022 after customer funds were misused, saying Bitget is nothing of the kind.

Data — what the numbers show

Lookonchain's breakdown spreads the haul across at least nine tokens. About 102.9 million XRP, worth roughly $157.5 million, was the largest single piece, followed by 31,890 ether at about $85.8 million. Stablecoins made up most of the remainder: about $34.8 million of USDT, $21.1 million of USDC and $19.7 million of USDT0, plus smaller amounts of Tether Gold, BNB, AVAX and TRX.

Measure	Figure
Total taken (Lookonchain)	~$357 million
XRP portion	~102.9 million tokens / ~$157.5 million
Ether portion	31,890 ETH / ~$85.8 million
Stablecoin portion (USDT, USDC, USDT0)	~$75.6 million combined
Protection fund	above $465 million
Bitget own capital	more than $1 billion

The gap between early tracker counts and the final breakdown is instructive. CoinMarketCap noted trackers had only seen about $183 million leave. The XRP leg alone is roughly $157 million, which suggests, though it is not confirmed, that the early counts largely missed the XRP transfers. On the market side, XRP's 24-hour volume of $4.49 billion is small next to a $96.81 billion market cap — the stolen 102.9 million tokens are a rounding error against that float.

Analysis — what it means for markets and tickers

XRP is the ticker to watch, and the report is explicit about why. At roughly $157 million it is the biggest single part of the haul, and it had drawn little attention before the breakdown. The second-order effect runs through supply: if the attacker sells on-market rather than laundering slowly through privacy tools, XRP absorbs the larger share of the pressure and ether the smaller one. The same logic applies to the stablecoin leg, except much of that balance was already converted into ether, which no central issuer can freeze.

Bitget's own BGB token faces a different question. Confirmation that no private keys leaked may ease one specific fear, because a key leak could have put more wallets at risk than the funds already moved. What BGB cannot escape is the withdrawal test, and the report does not disclose what BGB holders did during the freeze.

The counter-argument deserves weight. Chen's numbers are large relative to the loss: a protection fund above $465 million covers $357 million on its own, and Bitget says it holds more than $1 billion of its own capital on top. The limitation is that these are the company's own figures, and the report notes the exact entry point is still under investigation. Until the promised incident report lands, the reassurances remain Bitget's own account.

Positioning is the tell. Flow is one-directional right now — the attacker holds the tokens and decides when to move them, while exchange customers decide whether to stay. That asymmetry, not the loss size, is what the market is pricing.

Outlook — what to watch next

Three catalysts frame the next stretch. First, the reopening of withdrawals, which remained suspended at last report — Chen's claim that Bitget can absorb a run gets its first real test the moment customers can move money. Second, the full incident report, promised within 24 hours of the breach, which should show how attackers reached the backend system and whether the North Korea link can be confirmed. Third, on-chain movement of the 102.9 million XRP and 31,890 ether, which determines whether selling pressure arrives on venues or disappears into mixers.

On levels, the report names none, and the live data gives only XRP's $1.54 print. The stolen XRP is small against a $96.81 billion market cap, so the near-term question is behavioural rather than mechanical: does the market treat an exchange breach as a Bitget problem or a sector problem.

Frequently Asked Questions

What does the Bitget hack mean for XRP holders?

XRP is the largest single asset in the haul at roughly 102.9 million tokens worth about $157.5 million, so it carries the most potential selling pressure if the attacker dumps on-market. Against XRP's $96.81 billion market cap, that stake is small — under 0.2% of the float. The risk is sentiment and timing, not the size of the bag itself.

Why did early estimates of the Bitget loss differ so much?

Trackers initially saw only about $183 million leave, well short of the roughly $357 million final figure. The XRP portion alone accounts for about $157 million, which suggests the early counts largely missed those transfers. The report flags that reading as unconfirmed. The stablecoin leg was also quickly converted into ether, which no issuer can freeze, complicating tracking.

Can Bitget cover the loss without customer funds?

Chen says the protection fund, now above $465 million, covers the loss on its own, and that Bitget holds more than $1 billion of its own capital on top. That would put total resources well above the roughly $357 million taken. The caveat is that these are the company's own figures, reported before the full incident report.

Bottom Line

Bitget's loss is survivable on paper; the withdrawal queue, not the hacker, decides whether that holds.

Disclaimer: This article is for informational purposes only and does not constitute investment advice. CFD trading carries high risk of capital loss.