Bitget Hackers Drain $228 Million in 18 Minutes, Arkham Traces Funds Across Seven Blockchains

On September 24, attackers siphoned an estimated $350 million from Bitget wallets across seven blockchains. Arkham Intelligence tracked $228 million exiting the exchange in just 18 minutes, from 18:58 to 19:16 UTC.

Scope of the breach

Arkham identified transfers from five Bitget wallets on the XRP Ledger, Ethereum, Arbitrum, Optimism, BNB Chain, Avalanche and Base. The total amount reported by Bitget’s security notice is $351.6 million, which the exchange says is covered by its User Protection Fund of more than $464 million.

Asset breakdown

• ~$153 million in XRP – the largest single component, disputed by Bitget as originating from a cold wallet.
• ~$100 million converted to roughly 36,600 ETH.
• ~$25 million in USDT moved to the Rizzolver service.
• USDC transferred to Ethereum before being sold.
• ~$6.9 million in BNB traced to 12 wallets, with further deposits to Thorchain and Fixedfloat.

Rapid conversion and redistribution

Within ten minutes of the theft, attackers began swapping stablecoins and tokenized gold for ether using Uniswap, 1inch and Furucombo. Bridging services moved assets from Arbitrum, Optimism and Base to Ethereum by 4:04 p.m. EDT. The resulting ether was split among eight new addresses, holding about 68,300 ETH (≈$183 million) at the time of reporting.

Bitget’s response

Withdrawals were paused while the exchange conducted a security review; deposits and trading continued. Bitget asserts that its cold wallets remained secure and that the breach affected only hot and warm wallet infrastructure.

Ongoing investigation

Arkham has labeled 26 attacker‑associated addresses, providing a tracking framework for investigators. The dispute over the XRP source and the appearance of Thorchain in related fund movements indicate that the full attribution remains unresolved.