Bitget Confirms $351.6 Million Hack With Ethereum (ETH) in Attacker Wallet

Bitget Confirms $351.6M Wallet Breach

Cryptocurrency exchange Bitget confirmed on Thursday that unauthorized transfers struck part of its hot and warm wallet infrastructure, with estimated losses of approximately $351.6 million. Per the exchange's official announcement, its security systems flagged the anomalous movements at 18:31 UTC on September 24 and activated emergency response procedures within minutes. Founder and CEO Gracy Chen said cold wallets remain untouched and the incident is confined to the hot and warm tiers of Bitget's three-layer custody architecture. Withdrawals are temporarily suspended pending a security review, while deposits and trading continue to operate normally. The platform said it will publish hourly updates through official channels as the investigation proceeds.

exchange's official announcementhttps://x.com/bitget/status/2103236552482848927?ref_src=twsrc%5Etfw

On-Chain Sweep Pattern Emerges

The confirmation followed hours of on-chain alarm. Chain data showed a series of large transfers compressed into roughly 20 minutes, with funds leaving several Bitget-labelled hot wallets and at least one cold wallet. A single address, 0x770b...63Ee, appeared repeatedly as the receiver, pulling in Ethereum (ETH), AVAX, BNB, USDT, USDC and XAUT — a token backed by physical gold — from exchange-linked wallets. Researchers flagged the aggregation pattern as unusual: multiple wallets sending different assets to the same destination within a narrow window resembles the rapid sweeps seen during exchange breaches, though venues also consolidate funds internally during wallet maintenance or custody changes.

Protection Fund Pledges Coverage

In her disclosure, Chen moved to reassure customers that account balances remain accurate and client assets are protected. Wrote Chen: “User funds are safe. The full amount of this loss falls within the coverage of Bitget’s User Protection Fund, which currently holds over $464 million.” The exchange said its emergency response team engaged within minutes of the first anomalous transfer, identified and flagged the addresses tied to the abnormal flows, and formally notified law enforcement and on-chain security firms. Early social-media estimates of roughly $174 million — later climbing as more transactions surfaced — ultimately understated the confirmed scale by nearly half.

Wrote Chenhttps://x.com/GracyBitget/status/2103235655879074084?s=20

Three Hot Wallets, One Cold Under Scrutiny

Before the exchange spoke, on-chain telemetry had already outlined the blast radius. Three hot wallets and one cold wallet appeared affected, with roughly $530 million in assets still held across those addresses when the first reports landed and the last outbound transfer logged just minutes earlier. Users began reporting blocked withdrawals on social platforms, fueling breach speculation even as some accounts claimed — without verifiable evidence — that part of the moved funds was being converted into ETH. Real-time custody surveillance, a discipline increasingly augmented by AI crypto wallet monitoring systems, evidently did not catch this sweep until funds were already in motion.

Attacker Buys 7,111 ETH on Arbitrum

On-chain forensics revealed how the attacker began monetizing the haul. A freshly created wallet, beginning 0xe410, spent $19.67 million in USDT0 to buy 7,111 ETH on Arbitrum in just six minutes, routing through UniswapX and 1inch Fusion and paying up to 5% above spot — a premium typical of a buyer prioritizing speed over price. Unlike the stolen stablecoins, ETH is decentralized and far harder to freeze. Pseudonymous on-chain researcher DCF GOD first flagged the trade, and analytics firm Bubblemaps subsequently labeled the platform “potentially hacked” as roughly $183 million in assets moved across multiple chains into a single destination within about an hour.

Hacken Flagged Cold-Wallet Movement

Blockchain security firm Hacken was among the earliest to raise the alarm, reporting movement of USDT, ETH, BTC, AVAX and BNB from a cold wallet attributed to Bitget and valuing the suspected breach at roughly $100 million. The firm, whose audit practice spans yield farming protocols and centralized venues, opened an investigation as withdrawal complaints mounted. Hacken's figure proved conservative: estimates climbed through $176 million and $183 million before the exchange's own assessment nearly doubled them to $351.6 million. The gap illustrates how initial chain telemetry typically captures only the first phase of a multi-stage sweep before the full picture firms up. Readers tracking the market in real time can follow live spot and futures prices on MEXC.

Post-Mortem Due Within 24 Hours

Taken together, the sequence — a 20-minute multi-asset sweep into 0x770b10b273fC44Fe9197D6bF20F145c2e98463Ee, onward dispersal to follow-on addresses, and a six-minute ETH accumulation sprint — marks one of 2026's largest confirmed exchange breaches, and the drained total is verifiable on-chain by anyone tracking the attacker addresses. The root cause remains undisclosed; Bitget has committed to a full incident report with remediation steps within 24 hours, and our reading of the on-chain evidence is that the per-chain fragmentation of the haul is designed to frustrate freezing efforts. After Bybit's record $1.4 billion theft in February 2025 and $2.72 billion stolen industry-wide last year, custody architecture — not market direction — is again the binding constraint; our guide to the best crypto exchanges tracks how venues disclose fund segregation and insurance coverage.