A large-scale hacking incident occurred at cryptocurrency exchange Bitget, with a number of cryptocurrencies stolen, including Ripple (XRP). XRP accounted for the largest share of the total assets lost, drawing market attention.

■ How the Hack Occurred and the Scale of the Damage

According to overseas crypto media outlet Cointelegraph (CoinGape), Bitget said that unauthorized asset transfers occurred in some hot wallets and warm wallets on Thursday (local time), resulting in approximately $351 million worth of cryptocurrency being leaked. Of this, the XRP damage amounted to about $157.5 million, the largest among the stolen cryptocurrencies.

On-chain analysis platform Lookonchain reported that approximately 129 million XRP were stolen in the attack, with losses totaling around $158 million.

■ Bitget's Response... "Customer Assets Safe, Losses to Be Covered by Protection Fund"

Bitget CEO Gracy Chen and some on-chain analysts suspect the North Korean hacking organization Lazarus Group is behind the attack. According to CoinGape, CEO Chen said withdrawals were suspended immediately after the unauthorized transfers were detected. However, deposits and trading services continued to operate normally, and she explained that cold wallets were not attacked and customer assets remain safe.

Bitget stated that the losses can be covered by its customer protection fund, which held more than $464 million in assets at the time. CEO Chen emphasized that no private keys were compromised during the attack.

■ Method of the Hack... Backend Intrusion and Forged Transfer Details

According to CoinGape, Bitget's security team found in its initial investigation that the attackers breached the backend system used for wallet management and then forged transfer information. They then triggered Bitget's normal signing process so that outgoing asset transfers appeared to be approved transactions.

■ 31,890 Ethereum Among Stolen Assets... EVM Assets Swapped for ETH

CoinGape reported that XRP suffered the largest losses in the Bitget hack. Approximately 31,890 Ethereum (ETH) were also stolen, with losses estimated at around $86 million.

Blockchain analytics firm Nansen confirmed, while tracking one cluster of key on-chain addresses, that 40,000 ETH was moved in equal portions to four addresses. Other stolen assets included USDT, USDC, USDT0, tokenized gold XAUt, BNB, AVAX, and TRX.

According to CoinGape, the hackers have already swapped a significant portion of the assets stolen on Ethereum Virtual Machine (EVM)-based blockchains for Ethereum.

■ North Korea's Lazarus Group Named as Suspect... "Linked to AFX Hack"

The North Korean hacking organization Lazarus Group has been named as the suspected perpetrator of the Bitget hack. According to CoinGape, CEO Gracy Chen said in a livestream that some IP addresses used in the attack matched the virtual private network (VPN) usage patterns associated with the Lazarus Group. However, she noted that it has not yet been confirmed whether the Lazarus Group was the actual attacker.

The Lazarus Group has been blamed for a series of cryptocurrency theft incidents, including the $1.5 billion Bybit hack in 2025.

On-chain investigation specialist Spector also identified the Lazarus Group as the likely perpetrator of the Bitget hack. According to CoinGape, Spector claimed the attack is linked to the $24 million AFX Trade hack and specifically that the Lazarus Group's TraderTraitor was involved. He analyzed that the XRP stolen from Bitget went through cross-chain movements and that the flow of those funds is directly connected to the funds stolen in the hack of AFX, a decentralized perpetual futures exchange. However, suspicions about the perpetrator of this attack have not yet been definitively confirmed.

■ XRP Price Volatility Expands

Amid the Bitget hack, the price of XRP has also shown volatility.

[This article is by no means an investment recommendation. The content may merely reflect opinions, so please do not use it as a reference or material for investment. All investments are made at the discretion of each individual, and the final responsibility lies with the investor. This publication assumes no responsibility whatsoever.]