The September 24 Bitget hot-wallet incident involved 102.93 million XRP worth about $157.48 million, making XRP the largest single asset identified in the theft. Lookonchain also listed 31,890 ETH alongside stablecoins, tokenized gold, BNB, AVAX and TRX, while Bitget estimated total affected funds at about $351.6 million. The exchange said the loss is covered by its User Protection Fund, paused withdrawals, and kept deposits and trading open. Bitget CEO Gracy Chen said unauthorized transfers began at 18:31 UTC after a backend wallet system was compromised, transaction data was spoofed and the exchange's authorization process was triggered. She said private-key theft had been ruled out and cold wallets were unaffected. Most EVM-chain proceeds were swapped into 67,982 ETH worth about $183 million, but most of the XRP remained on the XRP Ledger, making the balance easier to monitor but harder to freeze without coordinated action. At 6:05 AM UTC on September 25, XRP traded at $1.53, up 2.6% over 24 hours, according to CoinGecko. Investigator SpecterAnalyst linked a smaller bridged XRP flow to funds from the July AFX incident, which the researcher attributed to TraderTraitor and, by extension, the Lazarus Group. That attribution is unconfirmed. Chen said some addresses resembled VPN patterns associated with a North Korea-linked group, while stressing that the identity was not confirmed. Bitget said user balances remained intact and that abnormal addresses had been reported to law enforcement and on-chain security firms. The exchange has not given a timetable for reopening withdrawals, saying it will announce a window when systems can support it. Until Bitget publishes its promised incident report, the XRP trail remains a tracing issue rather than a closed attribution.