Crypto exchange Bitget suffered what may be the largest exchange hack of 2026, with attackers draining $351.6 million after compromising a wallet backend and spoofing transaction data to trigger the exchange's own authorization process. The breach affected hot and warm wallets, while cold wallets remained secure and further unauthorized transfers have since been stopped.

$XRP Tops the Asset Breakdown

A breakdown from Lookonchain identified 102.93 million $XRP worth $157.48 million as the largest component of the stolen assets. XRP represents approximately 44.1% of the itemized total. The XRP holdings remain largely on the XRP Ledger, in contrast to other stolen assets.

Lookonchain reported that the attacker had swapped most of the stolen assets on Ethereum-compatible networks into 67,982 $ETH, valued at approximately $183 million. That conversion figure concerns assets on those networks, rather than establishing that the stolen XRP was exchanged for ETH.

The full Lookonchain breakdown includes roughly 102.93 million $XRP (about $157.48 million), 31,890 $ETH (about $85.75 million), 34.75 million $USDT, 21.05 million $USDC, 19.67 million USD₮0, 3,000 XAUt (about $12.82 million), 12,719 $BNB (about $9.88 million), 821,012 $AVAX (about $8.38 million), and 20.59 million $TRX (about $7.07 million).

How the Attack Worked and What Comes Next

According to CEO Gracy Chen, attackers compromised a critical backend system tied to Bitget's wallet infrastructure, used it to forge transfer data, and triggered the exchange's own authorized signing process to move funds out. A private key leak has been ruled out, which Chen described as eliminating a more severe risk scenario.

Chen said the attack is highly likely linked to North Korean hackers, citing IP addresses that match VPN patterns of a DPRK-associated group, though this has not been confirmed.

Bitget said its $464 million-plus User Protection Fund would cover the loss, while deposits and trading remain open and withdrawals are suspended pending a security review. Chen confirmed that abnormal addresses have been flagged and reported to law enforcement and on-chain security firms.

Sources:
CoinDesk: Bitget's $351 Million Hack Happened Via Spoofed Transfers, Not Private Keys
The Crypto Basic: XRP Tops List of Crypto Assets Taken in Bitget Hack
Bloomberg: Bitget Says $351 Million Affected in Breach, Halts Withdrawals