Blockchain analytics firm Lookonchain has identified 102.93 million XRP, valued at approximately $157.48 million at the time of its tracking, among the assets stolen in the security incident at cryptocurrency exchange Bitget. The figures were reported by BSCN in a post on X, citing Lookonchain's on-chain monitoring.

The XRP position represents the largest single asset identified so far in the stolen portfolio. A subsequent breakdown from Lookonchain put the total value of the identified assets at approximately $356.86 million, a figure that differs from Bitget's own estimate of $351.6 million.

XRP Remains Largely on the XRP Ledger

The movement of the stolen assets has differed across blockchain networks. Lookonchain reported that most of the assets taken from Ethereum-family networks were converted into 67,982 ETH, worth approximately $183 million at the time of tracking.

XRP, the native asset of the XRP Ledger, has followed a different path. According to information shared by BSCN, the 102.93 million XRP remains largely on the XRP Ledger rather than being converted into ETH.

The distinction is relevant to the ongoing on-chain tracking of the stolen funds. XRP transactions can be monitored directly on the XRP Ledger, while assets originating on Ethereum-compatible networks have undergone additional swaps that have resulted in a large ETH position. For anyone following the case, that means the largest single identified asset can be observed at the ledger level in its original form, while the swapped funds now make up a concentrated ETH position whose movements are likewise recorded on public blockchain data.

Lookonchain's asset breakdown also 31,890 ETH worth $85.75 million, along with 34.75 million USDT, 21.05 million USDC, 19.67 million USD₮0, 3,000 XAUt, 12,719 BNB, 821012 AVAX and 20.59 million TRX.

Bitget Flags Abnormal Addresses

Bitget has confirmed unauthorized transfers involving portions of its wallet infrastructure. The exchange said abnormal addresses connected to the incident had been flagged and reported to authorities and blockchain security firms.

The exchange has also said the incident affected parts of its hot and warm wallet infrastructure — internet-connected systems used to handle operational funds — while its cold wallets, which keep private keys offline, remained secure. That separation is a deliberate security design intended to limit exposure if internet-connected systems are compromised, which is what makes the cold wallets' integrity significant in this case. Bitget temporarily suspended withdrawals as it investigated the breach, while deposits and trading remained available, according to reports published after the incident.

Bitget CEO Gracy Chen later said preliminary findings pointed to a compromise involving a backend wallet system rather than a direct theft of private keys. The investigation into how the unauthorized transfers were authorized remains ongoing.

Investigation Continues as Funds Are Tracked

The difference between Bitget's reported $351.6 million loss and Lookonchain's later asset valuation reflects separate methods of measuring the affected funds. Lookonchain's figures are based on on-chain observations and asset valuations at the time of tracking, while Bitget's figure represents the exchange's own estimate. Lookonchain's numbers function as snapshots at specific moments — as its XRP valuation of roughly $157.48 million at the time of tracking illustrates — rather than fixed totals.

For now, the 102.93 million XRP remains the largest identified asset in the stolen portfolio, while a substantial portion of the funds originating on EVM-compatible networks has been converted into 67,982 ETH. Bitget's investigation and its efforts to trace the abnormal addresses remain ongoing. Developments to watch include further findings from Bitget's backend investigation, updated asset tallies from on-chain monitors, and whether the 102.93 million XRP continues to sit on the XRP Ledger, where its transfers remain directly observable.

Source: Hokanews | Reporting: Ethan Collins