{"id":78657,"date":"2026-09-25T16:11:09","date_gmt":"2026-09-25T16:11:09","guid":{"rendered":"https:\/\/crowdfundjunction.com\/blog\/bitget-hackers-drain-228m-in-18-minutes-arkham-tracks-7-chains\/"},"modified":"2026-09-25T16:11:09","modified_gmt":"2026-09-25T16:11:09","slug":"bitget-hackers-drain-228m-in-18-minutes-arkham-tracks-7-chains","status":"publish","type":"post","link":"https:\/\/crowdfundjunction.com\/blog\/bitget-hackers-drain-228m-in-18-minutes-arkham-tracks-7-chains\/","title":{"rendered":"Bitget Hackers Drain $228M in 18 Minutes, Arkham Tracks 7 Chains"},"content":{"rendered":"<p><b>(Originally posted on : Bitcoin News )<\/b><br \/>\n<\/p>\n<div>\n<div class=\"@container mb-[25px] rounded-sm overflow-clip py-0.5 pr-0.5 pl-2.5 bg-success-100\">\n<div class=\"flex flex-col gap-m overflow-clip rounded-[6px] !bg-success-10 p-3 @[420px]:p-m\">\n<h2 class=\"m-0 flex items-center gap-s text-[19px] !text-[#1c1c1c] md:text-[20px]\"><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"16\" height=\"10\" viewbox=\"0 0 16 10\" fill=\"none\" class=\"shrink-0 text-success-100\" aria-hidden=\"true\"><path d=\"M1 1.5h14\" stroke=\"currentColor\" stroke-width=\"2.5\" stroke-linecap=\"round\"\/><path d=\"M1 8.5h10\" stroke=\"currentColor\" stroke-width=\"2.5\" stroke-linecap=\"round\"\/><\/svg><span>Key Takeaways<\/span><\/h2>\n<ul class=\"m-0 flex list-none flex-col gap-m pl-0\">\n<li class=\"m-0 flex items-start gap-s !text-[#434248]\"><span class=\"mt-2 size-2 shrink-0 rounded-full bg-success-100\" aria-hidden=\"true\"\/><span class=\"text-body\">Arkham says $228 million left Bitget during an 18-minute period.<\/span><\/li>\n<li class=\"m-0 flex items-start gap-s !text-[#434248]\"><span class=\"mt-2 size-2 shrink-0 rounded-full bg-success-100\" aria-hidden=\"true\"\/><span class=\"text-body\">Attackers converted assets into ether and spread it across new wallets.<\/span><\/li>\n<li class=\"m-0 flex items-start gap-s !text-[#434248]\"><span class=\"mt-2 size-2 shrink-0 rounded-full bg-success-100\" aria-hidden=\"true\"\/><span class=\"text-body\">Bitget says its protection fund covers the estimated $351.6 million loss.<\/span><\/li>\n<\/ul>\n<\/div>\n<\/div>\n<h2>$228 Million Left Bitget in 18 Minutes<\/h2>\n<p>Bitget customers could not withdraw funds after attackers drained the crypto exchange on Sept. 24. Blockchain analytics firm Arkham Intelligence, which identifies wallets and maps cryptocurrency transfers, traced about $350 million leaving five Bitget wallets across seven chains between 2:31 and 5:23 p.m. EDT. Arkham has grouped addresses linked to the attackers to <a href=\"https:\/\/arkm.com\/explorer\/entity\/bitget-hacker\" target=\"_blank\" rel=\"noopener noreferrer\">show their holdings and transfers<\/a> together.<\/p>\n<p>The chains were the XRP Ledger, Ethereum, Arbitrum, Optimism, BNB Chain, Avalanche, and Base. Arkham\u2019s <a href=\"https:\/\/info.arkm.com\/research\/hacker-steals-350m-from-bitget-and-begins-on-chain-laundering\" target=\"_blank\" rel=\"noopener noreferrer\">tracking of the stolen funds<\/a> shows how the attackers began moving and exchanging assets soon after the transfers.<\/p>\n<p>The theft was concentrated in a short window. When Arkham published its Sept. 25 <a href=\"https:\/\/x.com\/arkham\/status\/2103454007607874022\" target=\"_blank\" rel=\"noopener noreferrer\">postmortem on X<\/a>, it had labeled 26 addresses associated with the attackers, giving investigators a way to follow transfers as the funds move. The firm stated:<\/p>\n<blockquote>\n<p>\u201cOf the $350M, $228M left Bitget in 18 minutes, from 18:58 to 19:16 UTC.\u201d<\/p>\n<\/blockquote>\n<figure id=\"attachment_850700\" aria-describedby=\"caption-attachment-850700\" style=\"width:932px\" class=\"wp-caption aligncenter\"><figcaption id=\"caption-attachment-850700\" class=\"wp-caption-text\">Arkham\u2019s Bitget Hacker portfolio shows about 68,466 ETH worth $185.13 million. The stolen XRP is held in separate XRP Ledger wallets and is not shown in this portfolio view. Source: Arkham Intelligence.<\/figcaption><\/figure>\n<p>Bitget\u2019s <a href=\"https:\/\/www.bitget.com\/support\/articles\/12560603896024\" target=\"_blank\" rel=\"noopener noreferrer\">security notice<\/a> estimates the affected amount at $351.6 million. The exchange says its User Protection Fund holds more than $464 million and covers the loss. Withdrawals remained paused during its security review, while deposits and trading continued, according to Bitget.<\/p>\n<p>The scale became clearer as investigators identified transfers beyond those in the <a href=\"https:\/\/news.bitcoin.com\/security\/bitget-hit-by-351m-hack-withdrawals-frozen-as-probe-begins\/\">initial reports of the breach<\/a>. Early estimates focused on roughly $174 million to $183 million moving from Bitget-labeled wallets. Bitget later put the total affected amount at about twice that range.<\/p>\n<h2>XRP Loss Raises a Wallet Classification Dispute<\/h2>\n<p>Arkham identified $153 million in XRP as the largest single part of the theft and described its source as a Bitget cold wallet. Bitget disputes that classification: It says its cold wallets remained secure and that the breach was confined to portions of its hot and warm wallet infrastructure. The two descriptions should be treated as competing accounts while the investigation continues.<\/p>\n<p>A <a href=\"https:\/\/www.bitcoin.com\/get-started\/wallet-security\/wallets-custody\/setting-up-your-own-cold-storage-bitcoin-wallet\/\" target=\"_blank\" rel=\"noopener noreferrer\">cold wallet keeps its private key offline<\/a>, while a hot wallet connects to the internet to process transactions. The dispute is whether the stolen XRP came from offline storage or Bitget\u2019s connected wallet infrastructure.<\/p>\n<p>The attackers moved ether to Ethereum from other chains and split it among fresh wallets, while the stolen XRP largely stayed in five addresses after the initial transfers. More than 99% of approximately 103 million XRP <a href=\"https:\/\/news.bitcoin.com\/exchanges\/bitget-hack-xrp-157m-cannot-be-frozen\/\">remained in five wallets<\/a> early Sept. 25, according to a separate account of the ledger transfers.<\/p>\n<h2>Attackers Swap Assets and Split Ether Across Wallets<\/h2>\n<p>Within 10 minutes of the theft, the attackers began selling stablecoins and tokenized gold for ether, Arkham reported. Arkham says $25 million in USDT went to Rizzolver, a service that fills UniswapX trades, in five $5 million transactions. Other swaps used Uniswap, a decentralized exchange; 1inch, which routes trades across exchanges; and Furucombo, which combines decentralized finance transactions. The attackers also moved USDC to Ethereum before selling it.<\/p>\n<p>Funds from Arbitrum, Optimism, and Base crossed to Ethereum through bridging services, a process Arkham says was done by 4:04 p.m. EDT. Arkham estimated that roughly $100 million in assets other than ether became about 36,600 ETH. The attackers then divided their holdings among new addresses; eight held about 68,300 ETH, worth $183 million, when Arkham posted its account. It reported no outgoing transfers from those eight addresses at that point.<\/p>\n<p>The BNB portion was still moving in Arkham\u2019s snapshot. It traced $6.9 million to 12 unlabeled BNB Chain wallets and reported deposits of at least $4.7 million to Thorchain and $2 million to Fixedfloat. Thorchain has also appeared in <a href=\"https:\/\/news.bitcoin.com\/kraken-user-loses-18-2m-in-crypto-social-engineering-attack-as-funds-move-via-thorchain-zachxbt\/\">tracking of funds stolen in a separate crypto theft<\/a>; that case does not establish who carried out the Bitget attack.<\/p>\n<\/p><\/div>\n<p><a href=\"https:\/\/news.bitcoin.com\/featured\/bitget-hackers-drain-228m-in-18-minutes-arkham-tracks-7-chains\/\">Source link <\/a><br \/>\n<br \/><\/p>\n","protected":false},"excerpt":{"rendered":"<p>(Originally posted on : Bitcoin News ) Key Takeaways Arkham says $228 million left Bitget during an 18-minute period. Attackers converted assets into ether and spread it across new wallets. Bitget says its protection fund covers the estimated $351.6 million loss. $228 Million Left Bitget in 18 Minutes Bitget customers could not withdraw funds after [&hellip;]<\/p>\n","protected":false},"author":11,"featured_media":78658,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0},"categories":[32],"tags":[],"_links":{"self":[{"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/posts\/78657"}],"collection":[{"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/users\/11"}],"replies":[{"embeddable":true,"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/comments?post=78657"}],"version-history":[{"count":0,"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/posts\/78657\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/media\/78658"}],"wp:attachment":[{"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/media?parent=78657"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/categories?post=78657"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/tags?post=78657"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}