Bitget Confirms $351.6 Million Wallet Breach; XRP Leads Asset Transfers

Key Facts

Bitget said unauthorized transfers from some of its hot wallets affected an estimated $351.6 million in assets in an incident detected on September 24, 2026. Tracking published by Lookonchain placed XRP at the top of the asset breakdown, with more than 102.9 million tokens valued at an estimated $157.48 million. The exchange temporarily suspended withdrawals while reviewing its systems, although it said deposits and trading remained available. That restriction gives customers an immediate operational consequence alongside the reported loss from the exchange's wallets. The final cost will depend on the investigation, the valuation of the transferred assets and any recovery.

Bitget said its systems detected the transfers at 18:31 UTC on September 24 and estimated affected assets at approximately $351.6 million. Lookonchain separately valued the assets it tracked at about $356.86 million using the prices applied in its calculation. The difference may reflect valuation time or tracking scope; it does not by itself indicate a second incident. The tracked assets include XRP, ETH, stablecoins and other tokens, making the breakdown broader than the XRP transfers alone. Each total therefore needs its source attached when assessing the scale or financial cost of the breach.

XRP accounted for $157.48 million in Lookonchain's breakdown, making it the largest listed asset category by value. A large transfer out of exchange wallets, however, is not the same as an immediate sale of all those tokens. Price effects depend on whether the assets move to trading venues, when any sales occur and how much liquidity is available to absorb them. Rapid selling could weigh on XRP, while assets left in traceable addresses would present a different near-term picture. The transfer amount measures potential exposure; on its own, it does not establish that an immediate sell-off occurred.

Lookonchain's breakdown also listed 31,890 ETH valued at about $85.75 million and about 34.75 million USDT worth roughly the same amount in dollars. It included USDC, USDT0 and other tokens as well, explaining why the overall estimate extends beyond the XRP transfers. XRP's position as the biggest single category therefore does not make it the entire reported loss. Dollar valuations for the different assets can respond differently to price changes, while the stablecoin figures reflect their values when tracked. Reading the composition alongside the total gives a clearer account of the incident than the largest line item alone.

Bitget said the affected area was confined to portions of its hot and warm wallet layers and that its cold wallets remained secure. Hot wallets support routine transfers, so a failure in their controls can quickly disrupt withdrawals even when other assets remain outside the affected area. The separation of custody layers makes the scope of the breach distinct from the exchange's total customer assets. Bitget said it activated its emergency response, flagged the receiving addresses and notified authorities and on-chain security firms. Its security notice did not provide a final technical cause for the unauthorized transfers.

Bitget said its User Protection Fund held more than $464 million and that the incident's estimated loss fell within the fund's coverage. That statement supports the company's assurance about customer balances, but it is not evidence that compensation has already been paid. Coverage, settlement of the loss and restoration of withdrawals are separate steps with different implications for users. The amount the exchange ultimately bears could change if asset valuations shift or some transferred funds are recovered. Customers' ability to move balances outside the exchange also depends on completion of the security review.

Bitget's service notice said withdrawals were temporarily unavailable while deposits and trading continued. An XRP holder may therefore be able to change a position within an account while still being unable to move the asset to an outside wallet. Continued trading alone does not show that the operational risks behind the withdrawal pause have ended. Access risk at the exchange concerns its services and controls, while the risk of holding XRP concerns the token's market price. Completion of the investigation and the decision to reopen withdrawals bear most directly on the first risk.

Three steps separate an unauthorized transfer from a price move: movement of the assets, an offer to sell them and execution against available liquidity. Lookonchain's estimates describe the first step but do not establish how much was sold in the steps that follow. Its $157.48 million valuation of transferred XRP therefore should not be treated as a confirmed value of completed sales. Subsequent movements of the assets would help show whether the supply available for trading has increased. The effect of any eventual sales would also depend on whether buyer demand absorbs them when they occur.

For an investor holding XRP away from Bitget, the direct market question is whether the transferred assets eventually reach trading venues. A customer holding XRP on the exchange also faces a temporary withdrawal restriction, even though trading within accounts continues. A prospective buyer may watch the destination of the transferred tokens before assuming the entire amount will become sellable supply. A short seller likewise needs to distinguish possible selling pressure from completed sales capable of moving the price. Those positions depend on later evidence about asset movements and service restoration, rather than the loss estimate alone.

Restoring withdrawals after the security review will be a practical test of Bitget's ability to resume the service restricted by the incident. The company said it would provide investigation updates, and its service notice refers to a root-cause and corrective-actions report after withdrawals are restored. If sufficiently detailed, that report should explain how unauthorized transfers passed through wallet controls and what changed to prevent a recurrence. Later figures on asset recovery or settlement of customer balances would clarify the actual cost against Bitget's initial $351.6 million estimate. Until then, any assessment of a lasting effect on XRP remains conditional on what happens to the transferred assets.