# Bitget

Date:: 2025-09-24

Time:: 18:31

Amount Stolen:: $350,000,000

Tags:: 👛


---

# Details

- $195,944,721 on EVM + TRX

- $125m on XRP

- $27m on ZEC


> At 18:31 UTC on September 24, 2026, Bitget’s security systems identified unauthorized transfers involving a limited number of hot wallets.

> Our security team immediately activated emergency response procedures and began a full investigation.  

> Based on our current assessment, approximately $351.6 million in assets were affected. Bitget’s cold wallets and the overwhelming majority of platform assets remain secure and unaffected.

> Most importantly, user funds remain protected. 

> The incident falls within the coverage of Bitget’s User Protection Fund, which currently holds more than $464 million.

> Customer account balances remain accurate, and deposits and trading continue to operate normally.

> As a precaution, withdrawals have been temporarily suspended while our teams complete a comprehensive security review.

> We have identified and flagged the relevant transfer addresses and have formally engaged law enforcement agencies and leading on-chain security partners.

> We are working around the clock to restore withdrawal services as soon as it is safe to do so.

> Bitget will provide further updates through our official channels.

> We will not speculate on the attack vector while the investigation remains ongoing. Our focus is on protecting users, securing all systems, and delivering complete transparency throughout this process.

- https://x.com/bitget/status/2103236552482848927


- https://x.com/GracyBitget/status/2103284265563902056 

- https://www.bitget.com/blog/articles/bitget-protection-fund-july-2026-351m-average


# Onchain

https://arkm.com/explorer/entity/23df1ca8-4c83-4548-aa99-3c6a85e83014

`0x770b10b273fC44Fe9197D6bF20F145c2e98463Ee` (EVM, Initial Theft)
`0xe410a2E5710Ee787bcaa63f52A3943ff71F0d946` (EVM)
`0x94A43df7687A8494948Be937400e9d5D33135DA0` (EVM)
`0xA6dD3F218B65E32Ccc37BE30f74884133c655545` (EVM)
`0x7c96279Ec1e888Aa56b9B836e0dB26ca48573E1C` (EVM)
`0x202e8CFCFEaE53b5050935a5E926ebB9679D28CD` (EVM)
`0xCaBF9748d125bf87ca45152B6EaeE68Ee6285652` (EVM)
`0xD2C2f029eFF5caCc686F24377CfdDcfc82d9F899` (EVM)
`0x600cfeDc6Bd65Fa79B604dC44964f419e45784b2` (EVM)
`0x2bca667D37AfE8D065ca46e3261E9442e77cBeAE` (EVM)
`0x469ac1406de92f82c0563477240a3627057425dc` (EVM)
`0xe07bd590e1198666230932bad5db3dbbe21e7d57` (EVM)
`0xeD5a394a7558929112848B7e97B569de6bbE1A51` (EVM)
`0xFd5EBe912e2061992437767e24e5BCb52a3f9e54` (EVM)
`0x9FA39d62095302431d7d4167a7E80F8Ec6eA4FA0` (EVM)
`0xD2C0A958343A3745F0b8BC591947dA6a5aB7b664` (EVM)
`0x23434D8831a97117d60070dA89451Ea24aF770D2` (EVM)
`0x274Ee3aeCC2b2D41a4D606155d7E0EbC3da68681` (EVM)
`0xa4d72E7632A4367Ba38cb35663e9963b5B7105B5` (EVM)
`0x5085b3d52b5587c18EF456FcbcDe9A11d48340F8` (EVM)
`0xA6BFd7FcaF4711dA1f61D5E91d03A2c7C72dB272` (EVM)
`0xDc2901f741B4003e32B8B752e97b8c4C1891dC63` (EVM)
`0x52f08Feb1B0Da609A5442514E2Bb43C99D25d284` (EVM)
`0x150889FE4fA7a7699588f75C4189FA9e721acFD3` (EVM)
`0xa0eC0DE60b51dB8D850e79A112Ab6222f7D2772a` (EVM)
`0x00154b473b0a4817dEf2dE1ec87aACA074b411A7` (EVM)
`0x2b03476bC4070e3019B3D5f4EC46edC27284ecd8` (EVM)
`TBWNguTTgezw9dVorX441C6nDrZpRxYwKD` (TRX, Initial Theft)
`t1WgMdtND8NF7NDUuYmq8MpMj1NTCXkMDVG` (ZCASH, Initial Theft)
`rwNhefsz1UQEusxhCvHip3RANinWi4CTck` (XRP, Initial Theft)
`rDRV9nLg8xbLsafKZnhNgWuE1TiSLE95hs` (XRP, Tranches)
`rwSjBrtxBC75TqZ5YvJ1TGfaRpQvVNsAKw` (XRP, Tranches)
`rH7oMFKBgdK99TPQctFVzddD7srRzyCqZn` (XRP, Tranches)
`r3UGfDM4ZyFSCzKH7TQEjgago9QoUJagtJ` (XRP, Tranches)
`r6NcwN3dR5ciyBv9XsLyMNc9Kg2FBCs7Y` (XRP, Tranches)
`rhdAf73TPX45LmHeZqxzLMdtd44jrY2w3p` (XRP, Laundry)
`rJudFXRambYmDykRC2EyFpucAHiZYntUtj` (XRP, Laundry)
`rHQMjheCWcuCzKofw6LTPHTZNcMeTxump3` (XRP, Laundry)
`rcrocCjViCJxBXirA8rfqCkT5ZSNkvuMw` (XRP, Laundry)
`rH2sXVPKXF4vLXnGgAwveyoEwSbs8KrUSV` (XRP, Laundry)
`rpzg9eG2D8om8YbMbjbmb8wX92rPyS2ECL` (XRP, Laundry)
`rDXb26tqYYHLU6bguebid45iNT9ytkVpsX` (XRP, Laundry)
`rHw5hnve5vBenPwtNT6ipvnpzkSKfsvMzP` (XRP, Laundry)
`rBcrNwytuY9RN9purWgW5mPwp2pQagm95E` (XRP, Laundry)
`rEVmm8LSn8GqQKqfKtdqgjJDKv6USiQQFr` (XRP, Laundry)
`rGE1wZRcUnbGYnRhveiNYH68ZryMaMJ7Cv` (XRP, Laundry)
`0x00154b473b0a4817def2de1ec87aaca074b411a7` (EVM, via Bridgers)
`0xc15c48e929acaf663ee554478d70f9a7d28252c7` (EVM, via Bridgers)
`0x2b6053902f86ff31c1f1407f1291c6aaadb29358` (EVM, via Bridgers)
`0xd55936e142f2bdcab693d807008ab29b0a8544f5` (EVM, via Bridgers)
`0xe9aeaa8e6a7537f35ff5cf15df60802846bb11ec` (EVM, via Bridgers)
`0x8e5c184dcd78752f7704d6be92fb18f1b9a25627` (EVM, via Bridgers)
`rwRnFu7QeQcd7p5qvyHkububNrfPRyEf2C` (XRP, Laundry)
`rnt3Kxjfb2TnvuBY5ZkakuuSyhgAoqaLbB` (XRP, Laundry)
`rnSzWAeWsgDGxLXJ1QY8afPoaSztChthoT` (XRP, Laundry)
`rHCPH9VCKvYRsQ2eJBFydpLqLqb5S6a3ET` (XRP, Laundry)
`0x02d5596740EeA4f6e3b0Fb19146746454d4Abf5e` (EVM, to Thorchain)
`13RcS1N99wQeD6WvjWqS1L6CwheEKBVC7T` (BTC, from Thorchain)
`0x8ED4d27f1fA2842dB4Fe2d6091d22830fe2d731e` (EVM)
`0x03DF4cb9aA0e73a847B2989C1Cd00A2A654B32f7` (EVM)
`0x62a8Cc80698d5F87FADd57ba9B247D36377e5b32` (EVM)
`0x8cec82ade21b8f4b01bda680dfb188d6b01a9129` (EVM)
`0x2399548147f367375b798256cc620cf2dbac7f10` (EVM)
`0x3a82a441f1e75d2022d17f6b082979c04fd67652` (EVM)
`0x7d837909b248aa1b092109b4aeb322b8a37a55d3` (EVM)
`0xF4D4b95CC4cc5C84F93A7cBa881dB3191159Fb52` (EVM)
`0x3F5426CA517b1e3f99ddF77044EFE1fBb8c93872` (EVM)
`0x4AA0F6B72D29c20819ecd63ea4966adD9A7f1427` (EVM)
`0x90474c56195577511c19F700728C3BDaBBE1434a` (EVM)
`0x816D75D5fb5691fD346eeE9bb5E030087ECa12df` (EVM)
`0x9C1BD98475D0f6282cDC15bDCAaA9a70758B1Ff1` (EVM)

## Connections

- 0x989ca8568c0c636ca9e062f8ff0f74450e0a4cc5 = AFX Hack
- 0xcbcfd64a96837d874943641fc9ba159c10d6cc80 = AFX Hack
- rcrocCjViCJxBXirA8rfqCkT5ZSNkvuMw = Bitget Hack
- 0xA0772d6E70D2c97CFB70628C7B00f666A6476feb = Overlap AFX + Bitget

- https://explorer.near-intents.org/?search=rcrocCjViCJxBXirA8rfqCkT5ZSNkvuMw

- https://x.com/SpecterAnalyst/status/2103286738961486186