Bitget Hackers Drain $228M in 18 Minutes, Arkham Tracks 7 Chains

$228 Million Left Bitget in 18 Minutes

Bitget customers could not withdraw funds after attackers drained the crypto exchange on Sept. 24. Blockchain analytics firm Arkham Intelligence, which identifies wallets and maps cryptocurrency transfers, traced about $350 million leaving five Bitget wallets across seven chains between 2:31 and 5:23 p.m. EDT. Arkham has grouped addresses linked to the attackers to show their holdings and transfers together.

The chains were the XRP Ledger, Ethereum, Arbitrum, Optimism, BNB Chain, Avalanche, and Base. Arkham’s tracking of the stolen funds shows how the attackers began moving and exchanging assets soon after the transfers.

The theft was concentrated in a short window. When Arkham published its Sept. 25 postmortem on X, it had labeled 26 addresses associated with the attackers, giving investigators a way to follow transfers as the funds move. The firm stated:

“Of the $350M, $228M left Bitget in 18 minutes, from 18:58 to 19:16 UTC.”

Bitget’s security notice estimates the affected amount at $351.6 million. The exchange says its User Protection Fund holds more than $464 million and covers the loss. Withdrawals remained paused during its security review, while deposits and trading continued, according to Bitget.

The scale became clearer as investigators identified transfers beyond those in the initial reports of the breach. Early estimates focused on roughly $174 million to $183 million moving from Bitget-labeled wallets. Bitget later put the total affected amount at about twice that range.

XRP Loss Raises a Wallet Classification Dispute

Arkham identified $153 million in XRP as the largest single part of the theft and described its source as a Bitget cold wallet. Bitget disputes that classification: It says its cold wallets remained secure and that the breach was confined to portions of its hot and warm wallet infrastructure. The two descriptions should be treated as competing accounts while the investigation continues.

A cold wallet keeps its private key offline, while a hot wallet connects to the internet to process transactions. The dispute is whether the stolen XRP came from offline storage or Bitget’s connected wallet infrastructure.

The attackers moved ether to Ethereum from other chains and split it among fresh wallets, while the stolen XRP largely stayed in five addresses after the initial transfers. More than 99% of approximately 103 million XRP remained in five wallets early Sept. 25, according to a separate account of the ledger transfers.

Attackers Swap Assets and Split Ether Across Wallets

Within 10 minutes of the theft, the attackers began selling stablecoins and tokenized gold for ether, Arkham reported. Arkham says $25 million in USDT went to Rizzolver, a service that fills UniswapX trades, in five $5 million transactions. Other swaps used Uniswap, a decentralized exchange; 1inch, which routes trades across exchanges; and Furucombo, which combines decentralized finance transactions. The attackers also moved USDC to Ethereum before selling it.

Funds from Arbitrum, Optimism, and Base crossed to Ethereum through bridging services, a process Arkham says was done by 4:04 p.m. EDT. Arkham estimated that roughly $100 million in assets other than ether became about 36,600 ETH. The attackers then divided their holdings among new addresses; eight held about 68,300 ETH, worth $183 million, when Arkham posted its account. It reported no outgoing transfers from those eight addresses at that point.

The BNB portion was still moving in Arkham’s snapshot. It traced $6.9 million to 12 unlabeled BNB Chain wallets and reported deposits of at least $4.7 million to Thorchain and $2 million to Fixedfloat. Thorchain has also appeared in tracking of funds stolen in a separate crypto theft; that case does not establish who carried out the Bitget attack.