Over $157M in XRP Stolen in Bitget Hack, North Korea’s Lazarus Group Suspected

Bitget crypto exchange said unauthorized transfers from some of its hot and warm wallets on Thursday drained nearly $351 million in crypto. XRP is the largest stolen asset, valued at nearly $157.5 million. Bitget CEO Gracy Chen and some on-chain analysts suspect North Korea’s Lazarus Group behind the attack.

102.93 Million XRP Coins Stolen in Bitget Hack

CEO Gracy Chen said Bitget detected the unauthorized transfers and froze withdrawals, while deposits and trading stayed open. She said cold wallets were not compromised and user funds are safe.

Bitget’s User Protection Fund, which held more than $464 million at the time, covers the loss. Gracy Chen added that private keys were not stolen. The security team initially identified that attackers breached a backend wallet system, forged transfer details, and then triggered Bitget’s normal signing process so the outgoing transfers looked authorized.

On-chain analytics platform Lookonchain reported almost 102.9 million XRP stolen, valued at almost $158 million. This makes XRP the biggest stolen crypto asset affected in the Bitget hack. Also, about 31,890 ETH worth $86 million was stolen. Nansen traced one of the main on-chain clusters and found 40,000 ETH split evenly across four addresses.

Other stolen crypto assets include USDT, USDC, USDT0, tokenized gold (XAUt), BNB, AVAX, and TRX. Hackers have already swapped a large share of the stolen funds on EVM chains into Ethereum (ETH).

Lazarus Group Is Suspected Behind the Attack

During a livestream, Gracy Chen said some IP addresses used in the attack matched VPN patterns tied to infamous North Korea’s Lazarus Group. She claimed the attribution is not yet confirmed. Lazarus Group is blamed for many crypto thefts, including the $1.5 billion Bybit hack in 2025.

Onchain Investigator Spector also claimed Lazarus Group is behind the Bitget hack. He linked this hack to the $24M AFX Trade hack and specifically attributed it to TraderTraitor.

He argued that the stolen XRP from Bitget was bridged and can be directly linked to the funds stolen in the AFX decentralized perpetuals exchange hack.

XRP Price Action amid Bitget Hack

XRP price slipped more than 1% after a more than 6% rebound in the past 24 hours. The price currently trades at $1.53, with a 24-hour low and high of $1.45 and $1.56, respectively. Furthermore, trading volume has dropped by 24% ahead of crypto options expiry today.

The derivatives market showed selling in the last few hours, as per CoinGlass data. The total XRP futures open interest climbed more than 2% to $3.64 in 24 hours. The 4-hour XRP futures OI was down more than 0.68%, with a 0.53% drop on CME and 0.51% on Binance.

Santiment Intelligence pointed out an XRP buying opportunity as the 365-day MVRV is around -11.75%. “Lower MVRV usually means less downside risk. Buying during that pain has historically offered better long-term setups,” it stated.

Meanwhile, analysts are also bullish on XRP due to strong technical chart patterns, such as a golden cross on the daily timeframe, and whale accumulations. Crypto analyst Ali Martinez predicted a further rally in XRP price to $2 if it breaks above $1.60.

Also Check: Top 10 DeFi Wallets Based on Their Connectivity, User Experience and Security