Bitget hack: how $387M left, and where it is now

01 · The first burstFive chains in fifteen seconds

At 19:01 UTC on September 24, 2026, Bitget's wallets started paying a stranger on five blockchains at once. First, 19.67 million USDT0, Tether's stablecoin on Arbitrum, left for the same address that had taken a small test transfer on Ethereum half an hour earlier. Within 15 seconds, USDC and a gold token had left on Ethereum, ETH on Optimism and Base, and XRP on the XRP Ledger. This was the heart of the Bitget hack. On every chain that shares Ethereum's address format, the money went to one address.

Bitget is a centralized exchange, or CEX. Its customers deposit coins, trade them and withdraw them. Like every CEX, it keeps some of that money in hot wallets, which pay out withdrawals on their own, day and night. The rest sits in warm and cold wallets that move less often. That evening, some of the hot and warm wallets paid the attacker instead.

Bitget first put the loss at about $352 million, and later raised it. We went to the chains to see how it left and where it went. Bitquery indexes every transfer on the chains involved, so we could pull out each one from a Bitget wallet to the attacker and check it on its own chain. We found 23 transfers on nine chains, all within three hours; the two on Zcash we added on September 30. Then we kept following the money as it moved. It is still moving, so every balance below comes with the time we checked it.

02 · The timelineTwo bursts, then three more waves

The first transfers were tests: 93 TRX on Tron and 0.84 ETH on Ethereum, eleven seconds apart. Bitget first gave that minute as the moment it spotted the theft. Its CEO later said the two tests were too small to trip its risk controls and raised no alert. Half an hour on, a much larger sum of USDT left on Ethereum, and then came the two bursts. Between them, a Bitget hot wallet on Zcash sent 17,198 ZEC. Bitget's monitoring flagged a gap at 19:05 UTC and blocked customer withdrawals. The second burst went out eleven minutes later anyway. The second one drew on a warm wallet on the XRP Ledger, which alone sent 91.4 million XRP.

That was not the end. Two more Ethereum transfers followed about an hour later, twelve seconds apart. Then Bitget's hot wallets on BNB Chain and Ethereum sent hundreds of balances into Bitget's reserve wallets within a few minutes. It looks like an emergency sweep, and it did not stop the theft. Fifteen minutes later a hot wallet on Avalanche sent the attacker 8.2 million USDC, and over the next half hour the XRP warm wallet sent 9.3 million XRP, the Zcash hot wallet another 1,719 ZEC, and an Ethereum hot wallet 223.2 ETH. Bitget's CEO posted the first public notice seven minutes after that.

03 · The haul$387M across nine chains

By the time that notice went up, the money was gone.

XRP was the largest single asset, about two fifths of the total. The Ethereum chain came second, with ETH, two stablecoins and the gold token XAUt, and Zcash third. Priced in the hour each transfer left, our total comes to just under Bitget's latest figure. Bitget's CEO put the count at 19 transfers. We count 23, three of them small tests.

Our labels mark every paying wallet as Bitget's except the one on Zcash, a chain missing from our labels. That wallet has made thousands of payments since 2021, the way an exchange hot wallet does. It has sent nothing since the second theft, which fits Bitget's pause on withdrawals, and Bitget has said ZEC was among what it lost. One of the labelled wallets, 0xffa8…cd54, is marked as a cold wallet in our labels and by public trackers. But it sends routine transfers most days and tops up the hot wallets, which is how a warm wallet behaves: the middle layer, between hot wallets that pay customers and cold ones that rarely move. Bitget says its cold wallets were not touched.

04 · The fingerprintSigned by Bitget's own wallets

How does that much leave an exchange in one evening? The transfers themselves hold part of the answer.

Each one was an ordinary transaction, signed by the Bitget wallet it left from, in the same queue as customer payouts. On Ethereum, a theft sits between two of them, with the next nonce and the same fee settings. The XRP transfers carry the same signing key and fee as a routine Bitget move made that morning.

One setting gives them away. Every Ethereum transaction sets a gas limit, the most it may spend on fees. Bitget's hot wallets use the same limit for almost every ETH payout and a fresh estimate for each token payout. Every theft used a fixed round number instead.

Theft transfers on the other EVM chains used fixed limits too. Zcash has a tell of its own. A payment there is built from coins the wallet received earlier, and each one it uses is an input. In thousands of other payments since the start of last year, the Zcash hot wallet never used more than 54 inputs. The two to the attacker used 1,074 and 956, and between them took almost everything the wallet held. That fits what Bitget's CEO, Gracy Chen, said later. In a live Q&A, as Cointelegraph reported, she said attackers broke into a backend system of the wallet service and faked transfer orders. She said those orders then went through Bitget's normal signing process, and that no private keys leaked. The chain cannot show what happened inside Bitget. It does show transfers that look like Bitget's own internal moves rather than customer payouts, signed by Bitget's wallets.

05 · The first hoursWhere the money went first

Once the money landed, the attacker moved fast, starting with the coins that could be frozen.

Tether and Circle, which issue USDT and USDC, can freeze tokens in a wallet. Here the tokens did not sit still long enough. The USDT was passed on eight minutes after it arrived and had all been sold for ETH within twenty minutes. The USDC and the gold token went the same way within about half an hour. Dumping 3,000 XAUt at once lined up with the gold token dipping more than 2% at its low that hour.

Money on Arbitrum, Avalanche, Optimism and Base came to Ethereum next. Most of it was sold for USDC on its home chain and crossed over Circle's CCTP bridge. The rest crossed as ETH through Stargate, Across, deBridge and Relay. The swaps ran through DEX aggregators, MetaMask Swaps among them. Most of that ETH met in one hub wallet on Ethereum, which passed 43,698 ETH on to five new wallets. By the next morning the ETH sat in nine wallets. Eight of them had not sent a single transaction.

06 · Into BitcoinTurning BNB and TRX into Bitcoin

The next morning, the stolen BNB started moving too. THORChain is a cross-chain DEX: anyone can swap a coin on one chain for a coin on another, and it needs no account. The attacker's wallets on BNB Chain sent it BNB again and again, and each swap named a Bitcoin address to be paid. By 14:05 UTC that day, THORChain had paid 51.26 BTC for that BNB.

The BNB is not the only thing turning into Bitcoin. We added up every swap we could match to a Bitcoin payment, and by 14:38 UTC, 126.71 BTC, about $10.6 million, had been paid out for stolen money. That is more than half of what the stolen BNB and TRX were worth, and about 2.8% of everything taken. At that point the big pile of ETH had not been touched, and most of the XRP still sat where it landed.

The Bitcoin side is messier. The same Bitcoin addresses also take a second stream: USDT from Tron, some of it routed through the attacker's own Ethereum wallets. Both streams meet in one Bitcoin wallet, so not all the Bitcoin in it is Bitget's money.

The Tron end of that stream has its own twist. One of the wallets feeding it was getting money five hours before the hack began, and it did not come out of nowhere. It is one of a set of Tron wallets that sprang up two days earlier. Each new one was topped up with TRX for fees by an older one, and the first USDT into the set came out of KuCoin.

Before the hack, that same wallet took in USDT from five older wallets. One of them had just taken 200,000 USDT out of Bybit and passed it on 15 minutes later. It looks like a desk that swaps money for several clients, and KuCoin and Bybit can see which of their accounts the money came from. The next morning, the attacker's Tron address sent that wallet 5.57 million stolen TRX, which puts it on the attacker's route. Whose money came in before the hack, and who runs these wallets, we cannot say.

07 · Where it is nowThe XRP is gone, and the ETH is moving

For two days, the biggest piles hardly moved. Then the attacker went back to them.

The XRP went first. The six accounts holding it sent it out in chunks, and by 07:43 UTC on September 27 they were empty. Each chunk passed through new accounts and ended in THORChain. Every swap there carries a memo that names the coin and the address to be paid, so we can see what the XRP became. Of all the stolen XRP, 90.5% was swapped for Bitcoin, and most of the rest for ETH.

Then the ETH. At 07:40 UTC on September 27, one of the eight holding wallets sent its first payment, and by 20:06 it was empty. Two minutes later a second one started, and it became the payout wallet: from September 28, four more holding wallets emptied into it. On September 29 a seventh began paying out on its own, straight to the same relay wallets. Together the seven have sent 51,899 ETH into new wallets, which passed it on to swap services and bridges.

About half of it went into THORChain for Bitcoin, as before. The next largest piece was bridged to Arbitrum over Stargate. Chainflip took a large share too, mostly as USDC and USDT swapped for Bitcoin. Some reached Bitcoin another way. Instead of swapping, the attacker paid ETH into a Chainflip liquidity account, the kind that supplies coins for other people's swaps and can take out another coin later. All the ETH that account received came from the attacker's wallets, and it has taken out 74.46 BTC. Much of the rest was swapped for USDC or USDT and bridged away. The USDC went over Circle's own bridge to Noble, a chain in the Cosmos network where Circle issues USDC, and to Solana. The USDT went back to Tron.

The last holding wallet has not moved. It has never sent anything, and its 10,000 ETH is worth about 7% of Bitget's count of the loss.

The stolen TRX had gone days earlier. From 08:25 UTC on September 25 the attacker drained the Tron wallet on Tron, and by 10:49 UTC it was empty: 20.59 million TRX had gone out in 22 payments. Most of it was swapped for USDT and bridged to Ethereum over USDT0. Some of that went straight into THORChain, to be paid out in Bitcoin, mostly to the same addresses the stolen BNB used.

Another part took the long way round. It was sold for ETH and sent through Umbra, a tool that pays out to one-time addresses. Then it was bridged to Arbitrum and straight back, and fed into Chainflip, a swap service that moves coins between chains. Chainflip paid it out as 21.65 BTC to five Bitcoin wallets. Every hop makes the trail longer to follow.

The ZEC stayed put for a day. Then the attacker began sending it on in small amounts to other addresses, which moved it into Ironwood, the private pool Zcash opened in July. Over five days, 12 small payments went in. On the morning of September 30 bigger ones followed, 2,924 ZEC in a few hours.

Zcash has a public side and private pools. On the public side, every payment shows who paid whom and how much, as on Bitcoin, which is how we could follow the stolen coins this far. Coins moved into one of its private pools hide the sender, the receiver and the amount, so the trail stops there. Anyone can move coins in at any time. Our Zcash rich list explains how the pools work.

One of the addresses the attacker used on the way into the pool also took coins from elsewhere. On September 30 it got 760 ZEC that had just come out of the private pool through another address, and sent it straight back in. Whose coins those were, the chain cannot say.

Very little has been frozen. Circle froze the USDC held in one attacker wallet early the next morning. Tether froze the USDT beside it at 12:19 UTC, and another 21,091 USDT in a second attacker wallet at 14:09. Together that is about $339,000. Native coins such as XRP, ETH, TRX and ZEC have no issuer that can freeze them.

In the early hours of September 26, the attacker's hub wallet on Ethereum, the one that had passed the stolen ETH on to five new wallets, started filling up again. First came the ETH left in the attacker wallet whose USDT Tether had frozen. Three minutes later, 457.9 ETH arrived from a wallet we had not seen before. The day before, that wallet got almost all its money in five payouts from Binance hot wallets, in USDT and ETH. So either the attacker is pulling money out of Binance by a route we have not found, or someone else sent it. Binance knows whose account that money came from. Five and a half hours later, the hub sent all of it to one of the holding wallets, which kept it until September 28 and then emptied into the payout wallet.

Several reports say the thief pushed 6,300 ETH, about $19 million, through Tornado Cash within hours. The chain does not show that. From the hack to early on September 26, 6,115 ETH went into Tornado's ETH pools on Ethereum, from 110 wallets. When we trace where each of those wallets got its money, three steps back, none leads to the attacker. About three quarters of it came from one wallet that got all its ETH a month before the hack. Another stream started on Tron, with money parked there since early September. Money that old cannot be Bitget's; whether the same people control it, the chain cannot tell. The 6,300 ETH and $19.4 million figures match another theft: a multisig wallet drained in December 2025, whose thief had pushed that much through Tornado by early January, as The Block reported at the time.

What is still in one place is the ETH in that last wallet and most of the stolen ZEC, and anyone can watch both.

08 · What Bitget saysBitget's account

Bitget's own statements cover what the chain cannot show. Chen posted the first notice on X that evening, and the company's account followed four minutes later. Bitget says the theft reached part of its hot and warm wallets and that cold wallets stayed safe. It says customer balances are accurate and the loss falls within its User Protection Fund, which Chen said holds over $464 million. On September 25, Bitget raised its count of the loss to about $387.5 million, from $351.6 million, after finding more stolen ZEC and TRX, The Record reported. Bitget said no new money had left. It launched a bounty that pays 5% of any stolen money frozen with outside help and another 5% of any it gets back, Crypto Times reported.

On September 28, in a live video on X, Chen gave a fuller account, The Block and U.Today reported. She said the attacker used a flaw in security software from an outside vendor to steal senior staff logins, then sent fake withdrawal orders to Bitget's wallet system that got past its risk checks. Monitoring flagged the theft at 19:05 UTC and blocked customer withdrawals. The wallet service was shut down at about 21:44, some twenty minutes after the last transfer we counted.

Withdrawals were paused. The next morning, Bitget's public coin list showed withdrawals switched off for every coin on every chain, while deposits stayed open on most of them. Bitget later said it would publish a plan to reopen them by 04:00 UTC on September 26. The plan came out that day. Bitcoin withdrawals reopened on September 28, and within an hour, Chen said, 4,098 BTC had gone out, Crypto Briefing reported. The plan put ETH next, on September 29, then USDT, with the other coins, fiat and P2P on October 2. She said the protection fund would be topped back up to over $300 million within a week. On September 30, Bitget shared what the two firms it hired, Mandiant and SlowMist, had found, BleepingComputer reported. The attackers broke into two outside security appliances through flaws no one had patched yet, and moved from there to the server that runs Bitget's wallet jobs. SlowMist traced the earliest malicious activity back to August 31. Its first and last theft transfers fall in the same minutes as the first and last ones we found.

Chen also said, as Cointelegraph and CNBC reported, that some attacker IP addresses matched VPN services used by a North Korean group. She added that the link is not certain, and we did not test it. The analytics firm Elliptic later said North Korea was likely behind the theft, Bloomberg reported. The obvious yardstick is the Bybit hack. About $1.5 billion was taken from Bybit in February 2025, and the FBI blamed North Korea five days later. Bitget's loss is about a quarter of that. For other thefts we have traced, see the Aquifer hack, the SecondFi drain and the Tron laundering circuit.

09 · How we did thisMethod and limits

We started from Bitget's wallets in our labels and the addresses that received the stolen money, and pulled every transfer between them. On Ethereum we also checked every large transfer out of Bitget that evening, to make sure none went to another new wallet. We checked each of the 23 on its own chain, then followed the money wallet by wallet, stopping at exchanges, bridges and swap services. When the XRP and the ETH began to move, we followed every payment through each new account or wallet it reached. Each THORChain swap carries a memo that names the coin and the address to be paid, and we read every one. For Chainflip and the bridges we used each service's own records. To test the Tornado Cash reports, we took every deposit into its Ethereum pools after the hack and traced each depositor's funding three steps back. Our labels hold no Zcash addresses. The Zcash transfers came to light on September 30, when the investigator ZachXBT posted the attacker's Zcash address; we checked both transfers on the chain, compared the paying wallet with its own history, and followed every coin the attacker sent until it went into the private pool or came back. Node data for each of those payments names the pool the coins went into. Prices are Bitquery's hourly prices.

Four limits apply. Bitget wallets missing from our labels would be missing here, as the Zcash ones were at first. On Zcash we see only the public side: once coins enter a private pool, we cannot follow them. We cannot say who controls the Bitcoin wallets at the end of the THORChain swaps. We did not follow the money past the bridges to Noble, Arbitrum and Tron. And the money is still moving, so every balance is tied to the time we checked it.

10 · The recordEvery transfer out of Bitget

FAQ

How much was stolen in the Bitget hack?

Bitget first put the loss at about $351.6 million, and on September 25 raised it to about $387.5 million after finding more stolen ZEC and TRX. Our own count of the 23 transfers we traced on nine blockchains, priced in the hour each one left, comes to $386.80M. The largest part was XRP, about two fifths of what we traced.

Is Bitget safe? Are customer funds covered?

Bitget says customer balances are accurate and that the loss falls within its User Protection Fund, which its CEO said holds over $464 million. Withdrawals were paused after the theft. Bitcoin withdrawals reopened on September 28, and the rest follow in stages to October 2. These are Bitget's claims; we have not tested them.

Was North Korea behind the Bitget hack?

Bitget's CEO said some attacker IP addresses matched VPN services used by a North Korean group, and that the link is not certain. Elliptic later said North Korea was likely behind it. We did not test that claim.

Where is the stolen money now?

Less of it is sitting still. As of 09:10 UTC on September 29, 10,000 stolen ETH sat in one wallet that has never sent a transaction. The XRP is gone, most of it swapped for Bitcoin through THORChain. Seven of the eight ETH holding wallets have paid out since September 27, mostly into Bitcoin, into USDC sent to the Cosmos chain Noble, and over bridges. The stolen TRX and BNB had mostly moved on by September 25. On Zcash, most of the stolen ZEC still sat in the attacker's address, and the rest was going into a private pool that cannot be followed. Circle and Tether had frozen about $339,000 of USDC and USDT. The tables in section 07 have the amounts and the times.

Did the Bitget hacker use Tornado Cash?

Not with the stolen money, as far as the chain shows. In the hours after the hack, about 6,115 ETH went into Tornado Cash on Ethereum, and none of the wallets behind it leads back to the attacker. The 6,300 ETH figure in some reports matches an earlier theft, reported in January 2026.

How does the Bitget hack compare to the Bybit hack?

About $1.5 billion was taken from Bybit in February 2025, and the FBI blamed North Korea. That makes Bitget's loss roughly a quarter the size of Bybit's.