How do crypto exchanges actually get hacked if they use cold wallets?

The full answer

What is known about the September 2026 Bitget loss?

On September 24, 2026, Bitget reported the loss of 103 million XRP in a breach that 24/7 Wall St. described as linked to North Korea [1]. The same outlet said on September 27, 2026 that there is no evidence connecting the hack to any specific XRP ETF inflows [1]. A 24/7 Wall St. article summary from September 2026 said hackers walked away from Bitget with $351.6 million, and that much of it sits beyond the reach of any organization that might try to stop them [1]. The sources held do not say whether that dollar figure covers only XRP.

This site’s sources, as of September 30, 2026, do not yet show step by step how exchanges holding cold wallets are breached.

The timeline, the cause and what happened to customers are covered on the page what happened in the September 2026 Bitget theft. As of September 30, 2026, this site does not hold a source that describes the attack route, so this page does not describe it.

Why doesn’t a cold wallet stop this kind of loss?

Ripple’s description of its own custody product shows how a working platform handles coins. In a Ripple announcement, Ripple described its managed custody as a way to provision wallets at scale, facilitate high-speed transaction signing and efficiently sweep funds to operational accounts [3]. That is Ripple’s account of its product, not an independent test.

Coins held offline are protected only while they stay offline. Coins that customers deposit, trade and withdraw have to pass through signing systems and operational accounts, and those are the parts an attacker can reach without touching cold storage. This follows from the custody description above; it is not a finding about Bitget.

Can funds move without anyone stealing a private key?

A February 2026 case on the XRP Ledger itself shows the idea. On February 19, 2026, a flaw was found in the proposed Batch amendment’s signature checking that could have let an attacker execute operations from victim accounts without possessing their private keys [2]. The XRPL Foundation said the amendment was in its voting phase, had not been activated on mainnet, and no funds were at risk [2]. An emergency release, rippled 3.1.1, was issued on February 23, 2026 [2].

The lesson carries to exchanges only as a principle. If the system that checks or approves signatures is fooled, keys can stay secret while money still moves. The Batch flaw was in unreleased ledger software, not in any exchange.

How did the Bybit loss happen without key theft?

As of September 30, 2026, I could not find any source documenting the February 2025 Bybit loss. The section stays empty of claims until primary or first-hand reporting is saved.

Are platform hacks becoming more or less frequent, by year?

As of September 30, 2026, I could not find any count of platform hacks by year from an official body or an analytics firm. No trend is stated here until one is sourced.

What happens to customers’ XRP after a platform hack?

That depends on the platform and on any cover it holds, which is set out on the page is my crypto insured like a bank account?.

Is self-custody safer against this kind of attack?

Moving coins off a platform swaps one set of risks for another, as the page on the exchange or in my own wallet sets out. The strongest challenge to reading platform hacks as a case for self-custody is a self-custody failure in the same month, examined on what happened with the D’CENT wallet hack. This page names that case only by link, because its evidence sits on that page.