Crypto exchangeget disclosed a security breach affecting approximately $351.6 million on September 24, 2026, with on-chain analytics platform Lookonchain subsequently publishing a breakdown that identified XRP as the largest single component of the stolen assets, according to The Crypto Basic.

$XRP Leads the Stolen Asset Breakdown

According to Lookonchain's asset breakdown, 102.93 million $XRP, valued at $157.48 million, made up the largest share of the stolen funds, accounting for approximately 44.1% of the itemized total. The breakdown listed nine cryptocurrencies and tokens in total, including $XRP, $ETH, stablecoins, and tokenized gold — a mix spanning major layer-1 assets, stablecoins, and commodity-backed tokens.

The itemized total came in approximately $5.26 million above Bitget's initial $351.6 million estimate. Neither the exchange's security notice nor the asset breakdown explained the discrepancy.

Unauthorized Transfers Detected at 18:31 UTC

Bitget CEO Gracy Chen said the exchange detected unauthorized transfers at 18:31 UTC and immediately activated its emergency response protocols. The platform temporarily suspended withdrawals pending a security review, a standard containment step exchanges use during active incidents to prevent further unauthorized outflows. Chen said customer balances remained protected, with deposits and trading continuing to operate while withdrawals were paused.

Attacker Converts Stolen Funds Into 67,982 ETH

Lookonchain, an on-chain analytics service, reported that the attacker had swapped most of the stolen assets on Ethereum-compatible networks into 67,982 $ETH, valued at approximately $183 million. The conversion figure concerns assets on those networks, rather than establishing that the stolen $XRP was exchanged for $ETH.

A portfolio snapshot from Arkham, a blockchain intelligence platform, grouped 22 addresses under its “Bitget Hacker” label, with combined holdings valued at approximately $188.93 million. Alongside the $ETH balance, the snapshot listed roughly 5,897 $BNB worth $4.58 million and 495.625 wrapped $ETH worth $1.33 million. Those figures describe tracked holdings at the time of the snapshot, rather than an additional loss on top of the original theft. Address labeling of this kind lets observers track where stolen funds sit in near real time, since transfers on public blockchains are visible as they occur.

Bitget Says Protection Fund Covers the Loss

In its initial notice, Bitget said the affected amount fell within the coverage of its User Protection Fund, which the exchange valued at more than $464 million — more than $112 million above the affected amount itself. Protection funds are reserves that exchanges maintain to absorb losses from security incidents, making them a key backstop for user balances when breaches occur.

About the Bitget Protection Fund 🛡️ The Bitget Protection Fund exists for moments like this. It holds 5,500 BTC, approximately $464M at current prices. All fund wallet addresses are public and can be verified on-chain by anyone, at any time. The fund is designated to protect…

— Bitget (@bitget) September 25, 2026

The exchange also said it had identified and flagged abnormal transfer addresses, notified law enforcement, and engaged blockchain security firms. Bitget committed to publishing a full incident report, including the cause and corrective measures, within 24 hours. The promised report, the outcome of the ongoing security review, and the status of paused withdrawals are the immediate items to watch as the incident develops.