Bitget customers were unable to withdraw funds after attackers drained the cryptocurrency exchange on September 24. Blockchain analytics firm Arkham Intelligence traced approximately $350 million leaving five Bitget wallets across seven blockchains between 2:31 and 5:23 p.m. EDT.
The affected chains were the XRP Ledger, Ethereum, Arbitrum, Optimism, BNB Chain, Avalanche, and Base. Of the $350 million total, $228 million left Bitget within an 18-minute window, from 18:58 to 19:16 UTC.
Largest Theft Component and Wallet Dispute
Arkham identified $153 million in XRP as the largest single portion of the theft. The firm described its source as a Bitget cold wallet, but Bitget disputed this classification, stating that its cold wallets remained secure and that the breach was confined to portions of its hot and warm wallet infrastructure. A cold wallet keeps its private key offline, while a hot wallet connects to the internet for transactions.
Bitget's security notice estimates the total affected amount at $351.6 million. The exchange stated that its User Protection Fund holds more than $464 million and covers the loss. Withdrawals remained paused during the security review, while deposits and trading continued.
Asset Movement and Conversion
Within 10 minutes of the theft, attackers began converting stolen assets into ether and spreading it across new wallets. Arkham reported that $25 million in USDT was sent to Rizzolver, a service that fills UniswapX trades, in five $5 million transactions. Additional swaps used Uniswap, 1inch, and Furucombo.
Funds from Arbitrum, Optimism, and Base were moved to Ethereum through bridging services by 4:04 p.m. EDT. Arkham estimated that approximately $100 million in assets other than ether became roughly 36,600 ETH. The attackers then divided their holdings among new addresses, with eight addresses holding approximately 68,300 ETH when Arkham published its analysis.
For BNB Chain assets, Arkham traced $6.9 million to 12 unlabeled wallets and reported deposits of at least $4.7 million to Thorchain and $2 million to Fixedfloat. The stolen XRP largely remained in five addresses after the initial transfers, with more than 99% of approximately 103 million XRP held in these wallets early on September 25.
