@bitget says it lost $351.6M yesterday. I followed it on chain overnight. On Ethereum and Arbitrum I can trace $146M out of Bitget's own wallets into one address, 0x770b10b2…e98463Ee. Right now 68,294.58 ETH, about $183M, sits in eight new wallets that haven't sent a single transaction.
Sep 25, 2026 · 6:46 AM UTC
1
4
19
367
The first transfer is a test: 0.84 ETH from the wallet Etherscan labels Bitget 6, at 18:31:11 UTC. Then 34,751,168 USDT at 18:58. At 19:01 come 12,852,046 USDC, 3,000 XAUT from Bitget 5, 7,130 ETH, and 19,668,851 USDT0 on Arbitrum. Bitget 35 adds 15,362 ETH. The last transfer from Bitget 6 to that address is at 21:23:11, 2 hours 52 minutes after the first.
1
79
Stablecoins went first. The USDT reached a swap wallet at 19:07, and by 19:17 all of it had gone to UniswapX fillers and Uniswap pools. From leaving Bitget to being sold it lasted 18 minutes. USDC was gone by 19:20 and the gold by 19:29. On Arbitrum the USDT0 went out in 14 transfers between 19:36 and 19:42. The Ethereum stables alone came back as 22,612.69 ETH.
1
1
82
Then the bridges. More ETH arrived from other chains through Stargate and Across. At least 27,569,588 USDC was minted on Ethereum to four attacker wallets between 20:25 and 22:39 UTC through Circle's CCTP, then sold for ETH on MetaMask Swaps. All of it went through one hub, 0xA6dD3F21…3c655545: 43,697 ETH in, then out again 10,000 at a time.
1
1
37
@bitget says no private key was stolen: a backend system was compromised and fed forged transaction data to Bitget's own approval process. Nothing on chain contradicts that, and nothing on chain can confirm it. Every one of these transfers is a normal signed transaction from a Bitget wallet. From the chain alone you can't tell a forged approval from a stolen key.
1
1
35
A detail I didn't expect. At 19:05:11 the attacker sent 0.1 ETH to test his swap wallet. 36 seconds later an address-poisoning bot sent him dust from an address that starts with 0x7C96 and ends in 3E1C, like the real one. I counted at least 15 lookalike addresses sending the attacker fake USDT, USDC and ETH during the night, hoping he'd copy the wrong one. He never did.
1
26
The eight wallets hold 10,000, 10,000, 4,596.47, 10,000, 10,000, 10,000, 10,000 and 3,698.10 ETH. Full addresses in the reply. Bitget says withdrawals are paused and its $464M protection fund covers the loss. I haven't traced BNB Chain, Avalanche or Bitcoin, which is where the rest of the $351.6M should be.
1
1
42
0xD2C2f029eFF5caCc686F24377CfdDcfc82d9F899
0x600cfeDc6Bd65Fa79B604dC44964f419e45784b2
0xDc2901f741B4003e32B8B752e97b8c4C1891dC63
0x9FA39d62095302431d7d4167a7E80F8Ec6eA4FA0
0xA6BFd7FcaF4711dA1f61D5E91d03A2c7C72dB272
0xFd5EBe912e2061992437767e24e5BCb52a3f9e54
0xeD5a394a7558929112848B7e97B569de6bbE1A51
0x52f08Feb1B0Da609A5442514E2Bb43C99D25d284
1
35