Bitget hack: how $352M left, and where it is now

01 · The first burstFive chains in fifteen seconds

At 19:01 UTC on September 24, 2026, Bitget's wallets started paying a stranger on five blockchains at once. First, 19.67 million USDT0, Tether's stablecoin on Arbitrum, left for the same address that had taken a small test transfer on Ethereum half an hour earlier. Within 15 seconds, USDC and a gold token had left on Ethereum, ETH on Optimism and Base, and XRP on the XRP Ledger. This was the heart of the Bitget hack. On every chain that shares Ethereum's address format, the money went to one address.

Bitget is a centralized exchange, or CEX. Its customers deposit coins, trade them and withdraw them. Like every CEX, it keeps some of that money in hot wallets, which pay out withdrawals on their own, day and night. The rest sits in warm and cold wallets that move less often. That evening, some of the hot and warm wallets paid the attacker instead.

Bitget puts the loss at about $352 million. We went to the chains to see how it left and where it went. Bitquery indexes every transfer on the chains involved, so we could pull out each one from a Bitget wallet to the attacker and check it on its own chain. We found 21 transfers on eight chains in under three hours. Then we followed the money into the next morning. It is still moving, so every balance below comes with the time we checked it.

02 · The timelineTwo bursts, then three more waves

The first transfers were tests: 93 TRX on Tron and 0.84 ETH on Ethereum, eleven seconds apart. Bitget later gave that same minute as the moment its systems spotted the theft. Half an hour on, a much larger sum of USDT left on Ethereum, and then came the two bursts. The second one drew on a warm wallet on the XRP Ledger, which alone sent 91.4 million XRP.

That was not the end. Two more Ethereum transfers followed about an hour later, twelve seconds apart. Then Bitget's hot wallets on BNB Chain and Ethereum sent hundreds of balances into Bitget's reserve wallets within a few minutes. It looks like an emergency sweep, and it did not stop the theft. Fifteen minutes later a hot wallet on Avalanche sent the attacker 8.2 million USDC, and over the next half hour the XRP warm wallet sent 9.3 million XRP and an Ethereum hot wallet sent 223.2 ETH. Bitget's CEO posted the first public notice seven minutes after that.

03 · The haul$352M across eight chains

By the time that notice went up, the money was gone.

XRP was the largest single asset, a bit under half of the total. The Ethereum chain came second, with ETH, two stablecoins and the gold token XAUt. Priced in the hour each transfer left, our total comes to a little more than Bitget's figure. The gap is down to the prices used. Bitget's CEO put the count at 19 transfers. We count 21, three of them small tests.

Our labels mark every paying wallet as Bitget's. One of them, 0xffa8…cd54, is marked as a cold wallet in our labels and by public trackers. But it sends routine transfers most days and tops up the hot wallets, which is how a warm wallet behaves: the middle layer, between hot wallets that pay customers and cold ones that rarely move. Bitget says its cold wallets were not touched.

04 · The fingerprintSigned by Bitget's own wallets

How does that much leave an exchange in one evening? The transfers themselves hold part of the answer.

Each one was an ordinary transaction, signed by the Bitget wallet it left from, in the same queue as customer payouts. On Ethereum, a theft sits between two of them, with the next nonce and the same fee settings. The XRP transfers carry the same signing key and fee as a routine Bitget move made that morning.

One setting gives them away. Every Ethereum transaction sets a gas limit, the most it may spend on fees. Bitget's hot wallets use the same limit for almost every ETH payout and a fresh estimate for each token payout. Every theft used a fixed round number instead.

Theft transfers on the other EVM chains used fixed limits too. That fits what Bitget's CEO, Gracy Chen, said later. In a live Q&A, as Cointelegraph reported, she said attackers broke into a backend system of the wallet service and faked transfer orders. She said those orders then went through Bitget's normal signing process, and that no private keys leaked. The chain cannot show what happened inside Bitget. It does show transfers that look like Bitget's own internal moves rather than customer payouts, signed by Bitget's wallets.

05 · The first hoursWhere the money went first

Once the money landed, the attacker moved fast, starting with the coins that could be frozen.

Tether and Circle, which issue USDT and USDC, can freeze tokens in a wallet. Here the tokens did not sit still long enough. The USDT was passed on eight minutes after it arrived and had all been sold for ETH within twenty minutes. The USDC and the gold token went the same way within about half an hour. Dumping 3,000 XAUt at once lined up with the gold token dipping more than 2% at its low that hour.

Money on Arbitrum, Avalanche, Optimism and Base came to Ethereum next. Most of it was sold for USDC on its home chain and crossed over Circle's CCTP bridge. The rest crossed as ETH through Stargate, Across, deBridge and Relay. The swaps ran through DEX aggregators, MetaMask Swaps among them. Most of that ETH met in one hub wallet on Ethereum, which passed 43,698 ETH on to five new wallets. By the next morning the ETH sat in nine wallets. Eight of them have never sent a single transaction.

06 · Into BitcoinTurning BNB into Bitcoin

The next morning, the stolen BNB started moving too. THORChain is a cross-chain DEX: anyone can swap a coin on one chain for a coin on another, and it needs no account. The attacker's wallets on BNB Chain sent it BNB again and again, and each swap named a Bitcoin address to be paid. By 10:40 UTC that morning, THORChain had paid 50.27 BTC for that BNB, and more swaps were still in flight.

The Bitcoin side is messier. The same Bitcoin addresses also take a second stream: USDT from Tron, some of it routed through the attacker's own Ethereum wallets. Both streams meet in one Bitcoin wallet, so not all the Bitcoin in it is Bitget's money.

The Tron end of that stream has its own twist. One of the wallets feeding it was getting money five hours before the hack began, and it did not come out of nowhere. It is one of a set of Tron wallets that sprang up two days earlier. Each new one was topped up with TRX for fees by an older one, and the first USDT into the set came out of KuCoin.

Before the hack, that same wallet took in USDT from five older wallets. One of them had just taken 200,000 USDT out of Bybit and passed it on 15 minutes later. It looks like a desk that swaps money for several clients, and KuCoin and Bybit can see which of their accounts the money came from. The next morning, the attacker's Tron address sent that wallet 5.57 million stolen TRX, which puts it on the attacker's route. Whose money came in before the hack, and who runs these wallets, we cannot say.

07 · Where it is nowMost of it has not moved

By the next morning, the biggest piles were sitting still.

The ETH on Ethereum, worth about $186 million, sits in wallets that have never sent anything. On the XRP Ledger a small slice has moved on, and the rest waits in six accounts.

The TRX on Tron is another story. From 08:25 UTC the attacker started draining the Tron wallet, and by 10:40 UTC, 19.87 million TRX had gone in 21 payments, leaving 0.72 million. Most of it was swapped for USDT and bridged to Ethereum over USDT0. Some of that went straight into THORChain, to be paid out in Bitcoin, mostly to the same addresses the stolen BNB used.

Another part took the long way round. It was sold for ETH and sent through Umbra, a tool that pays out to one-time addresses. Then it was bridged to Arbitrum and straight back, and fed into Chainflip, a swap service that moves coins between chains. Every hop makes the trail longer to follow.

Very little has been frozen. Circle froze the USDC held in one attacker wallet early the next morning. Tether had not frozen the USDT in that same wallet when we last checked. Native coins such as XRP, ETH and TRX have no issuer that can freeze them. For now, the attacker still holds most of what it took, in wallets anyone can watch.

08 · What Bitget saysBitget's account

Bitget's own statements cover what the chain cannot show. Chen posted the first notice on X that evening, and the company's account followed four minutes later. Bitget says the theft reached part of its hot and warm wallets and that cold wallets stayed safe. It says customer balances are accurate and the loss falls within its User Protection Fund, which Chen said holds over $464 million.

Withdrawals were paused. The next morning, Bitget's public coin list showed withdrawals switched off for every coin on every chain, while deposits stayed open on most of them. We saw no date for turning withdrawals back on in the posts we read.

Chen also said, as Cointelegraph and CNBC reported, that some attacker IP addresses matched VPN services used by a North Korean group. She added that the link is not certain, and we did not test it. The obvious yardstick is the Bybit hack. About $1.5 billion was taken from Bybit in February 2025, and the FBI blamed North Korea five days later. Bitget's loss is about a quarter of that. For other thefts we have traced, see the Aquifer hack, the SecondFi drain and the Tron laundering circuit.

09 · How we did thisMethod and limits

We started from Bitget's wallets in our labels and the addresses that received the stolen money, and pulled every transfer between them. On Ethereum we also checked every large transfer out of Bitget that evening, to make sure none went to another new wallet. We checked each of the 21 on its own chain, then followed the money wallet by wallet, stopping at exchanges, bridges and swap services. Prices are Bitquery's hourly prices.

Three limits apply. Bitget wallets missing from our labels would be missing here. We cannot say who controls the Bitcoin wallets at the end of the THORChain swaps. And the money is still moving, so every balance is tied to the time we checked it.

10 · The recordEvery transfer out of Bitget

FAQ

How much was stolen in the Bitget hack?

Bitget puts the loss at about $351.6 million. Our own count of the 21 transfers, priced in the hour each one left, comes to a little more. The largest part was XRP, a bit under half of the total.

Is Bitget safe? Are customer funds covered?

Bitget says customer balances are accurate and that the loss falls within its User Protection Fund, which its CEO said holds over $464 million. Withdrawals were paused after the theft, and the next morning its public coin list showed them off for every coin. These are Bitget's claims; we have not tested them.

Was North Korea behind the Bitget hack?

Bitget's CEO said some attacker IP addresses matched VPN services used by a North Korean group, and that the link is not certain. We did not test that claim.

Where is the stolen money now?

Most of it had not moved when we last checked. The ETH sat in nine Ethereum wallets and the XRP in six accounts. The stolen TRX and BNB had mostly moved on, and part of it was swapped into Bitcoin. Circle had frozen one wallet's USDC. The table in section 07 has the amounts and the time.

How does the Bitget hack compare to the Bybit hack?

About $1.5 billion was taken from Bybit in February 2025, and the FBI blamed North Korea. That makes Bitget's loss roughly a quarter the size of Bybit's.