Most of Bitget's $387.5 million hack loss sits untouched in attacker wallets
Bitget now puts its September breach at $387.5 million, and AMLBot estimates $343 million of it sat untouched in 13 attacker wallets on Sept. 25. The phased withdrawals due from Sept. 28 are the better guide to whether customer money is safe.
The Investor · Invest desk
What happened
- The coins went from TRX into USDT, to Ethereum via USDT0, into about 145 ETH, then through THORChain into roughly 4.59 BTC before being split up.
- Bitget first put the Sept. 24 loss at $351.6 million, then added Zcash and TRON assets taken in the original incident, saying there were no new thefts.
- The stolen assets included ETH, XRP, USDT, USDC, USDT0, ZEC, XAUt, BNB, AVAX and TRX.
Why it matters
- What it costs cost Every batch that follows the 4 BTC through CoinJoin is harder to trace or blacklist, and whatever cannot be recovered is a loss that Bitget or its customers end up absorbing.
- Who has to decide decision Depositors face a queueing choice: an early phase gets money out sooner, while waiting buys evidence about whether later phases clear on time.
- What it limits constraint With no full root-cause report published, customers and counterparties deciding whether to leave balances on Bitget have only the exchange's word that the flaw is fixed.
Next story · Invest · Oct 3
Issuers and protocols have frozen about 0.2% of the $387 million taken from BitgetConfirmed3 publishers
Take AMLBot's roughly $389 million tracked total and subtract the $343 million it counted as dormant, and about $46 million had moved by Sept. 25 [4][15]. crypto.news reported that the CoinJoin activity is only a small part of the funds linked to the breach [18]. Of the 4.59 BTC the route produced, AMLBot tied roughly 4 BTC, about 87%, back to the Bitget TRON wallet [19]. Its tracked base also sits about $1.5 million above Bitget's own $387.5 million [1][16].
The mixer link rests on one firm's analysis. Public ledgers record the transfers, swaps and cross-chain activity, but the purpose of each transaction is inferred from the flow and from address attribution [17]. The Binance News summary that repeated the sequence on Sept. 27 cited reports based on AMLBot's tracing [17].
From here the attacker can stay patient and leave the thirteen wallets alone while the addresses stay on Bitget's published list and AMLBot's blacklist [9][12]. Or the 4 BTC round was a trial. By Sept. 27, three days after the breach, the route had already crossed four networks (TRON, Ethereum, THORChain, Bitcoin) [20][11]. CoinJoin makes tracing harder because observers cannot match one input to one output [14]. The third possibility is that Bitget's figure moves again. Its first revision added $35.9 million, or 10.2%, by reclassifying assets from the original incident [13].
The breach hit portions of the hot and warm wallets. The cold wallets stayed secure, and deposits and trading ran through the withdrawal suspension [7]. An exchange in that position has lost the float it pays withdrawals from. Whether the rest of the balance sheet covers that gap shows up only when customers start taking money out [6].
The counter-case is that a staged restart is ordinary caution after a patch. Bitget's preliminary findings pointed to a compromise of backend wallet infrastructure, and CEO Gracy Chen said private keys remained secure while investigators worked to identify the intrusion path [3]. The reporting does not describe how long each phase lasts or which of the ten affected assets come first [8].
The worry is wrong if every affected asset, ZEC and XAUt included, can be withdrawn on the schedule Bitget sets, with no phase pushed back [6][8]. A delayed phase, or a second upward revision to the loss, would point the other way [13].
What to watch
- Any movement out of the thirteen wallets AMLBot counts as dormant, or further CoinJoin rounds it ties to Bitget addresses.
- A Bitget statement on whether customer balances in the affected assets are covered in full, and from which funds.
Information, not investment advice. This story is general information about companies and markets, drawn from cited reporting. It is not a recommendation to buy, sell or hold any security; check the cited sources before acting.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence66
- Adoption
- Not scored
- Hype gap+20
- Incentives60
- Confidence62
Perspective Coverage
15 publishers- Builder
- Builder 25%
- Operator
- Operator 43%
- Investor
- Investor 32%
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Bitget now confirms approximately $387.5 million was transferred to attacker-controlled addresses during the September breach.
- [2]
Bitget initially said the Sept. 24 incident affected about $351.6 million; the revised total includes Zcash and TRON assets missing from the initial estimate, and Bitget said the increase did not result from new thefts.
- [3]
Bitget's preliminary findings pointed toward a compromise involving backend wallet infrastructure rather than a leak of private keys; CEO Gracy Chen said private keys remained secure while investigators worked to identify the exact intrusion path.
- [4]
AMLBot estimated about $343 million, around 88% of the roughly $389 million it was tracking, remained dormant across thirteen attacker wallets as of Sept. 25.
- [5]
Bitget said its security team identified the attack path and fixed the underlying vulnerability, but it has not publicly released a complete technical root-cause report.
- [6]
Bitget plans phased withdrawals from Sept. 28 after identifying and fixing the underlying security vulnerability.
- [7]
The unauthorized transfers came from portions of Bitget's hot and warm wallet infrastructure; Bitget detected the activity at 18:31 UTC on Sept. 24, suspended withdrawals, kept deposits and trading operational, and said cold wallets remained secure.
- [8]
Affected assets included ETH, XRP, USDT, USDC, USDT0, ZEC, XAUt, BNB, AVAX and TRX.
- [9]
Bitget published primary attacker-controlled addresses on Ethereum-compatible networks, XRP Ledger, Zcash and TRON as part of its recovery work.
- [10]
AMLBot said on Sept. 27 that its tracing connected roughly 4 BTC in one Wasabi CoinJoin round to funds originating from a Bitget-linked TRON wallet, describing the activity as an apparent attempt to obscure the movement of stolen assets.
- [11]
According to AMLBot, the attacker converted TRX into USDT, moved it to Ethereum via USDT0, swapped it into about 145 ETH, moved the ETH through THORChain into about 4.59 BTC, and split the Bitcoin into smaller amounts before a Wasabi CoinJoin round; the funds moved through four networks.
- [12]
AMLBot said it had blacklisted the linked addresses and is continuing to monitor the Bitcoin for further CoinJoin activity.
- [13]
Bitget's revision added about $35.9 million, roughly 10.2%, to its initial loss estimate.
- [14]
CoinJoin combines Bitcoin inputs and outputs from multiple participants in a single transaction, which can make tracing more difficult because observers cannot simply map one input to one output.
- [15]
About $46 million of the funds AMLBot was tracking was not dormant as of Sept. 25.
- [16]
AMLBot's tracked base is about $1.5 million above Bitget's confirmed figure.
- [17]
The attribution remains AMLBot's blockchain analysis; public records show transfers, swaps and cross-chain activity, but the purpose of each transaction is inferred from the observed flow and address attribution. A Binance News summary published Sept. 27 repeated the same sequence, citing reports based on AMLBot's tracing.
- [18]
The CoinJoin activity represents only a small part of the funds linked to the breach.
- [19]
AMLBot tied roughly 87% of the 4.59 BTC produced on the route back to the Bitget TRON wallet.
- [20]
The traced funds reached a CoinJoin round within three days of the breach.
Sources
15 independent publishers whose own reporting we read for this story.
- bankless.comBitget Hacked for $351.6M
1 article · September 25, 2026
- [SECURITY NOTICE] Bitget exchange hot wallets Incident — September 24, 2026 | Bitget Support Center
bitget.com
3 articles · September 24, 2026
- cnbc.comCrypto platform Bitget suspects North Korea in $352 million hack
1 article
- cointelegraph.comBitget confirms $351M security breach, suspends withdrawals
5 articles · September 25, 2026
- crowdfundinsider.comCrypto Exchange Hack : Bitget’s $352 Million Breach Came From Spoofed Transfers, Not Stolen Keys
1 article · September 25, 2026
- crypto.newsBitget probe points to backend breach after $351.6M hack
3 articles · September 27, 2026
- cryptobriefing.comBitget halts withdrawals after $351M hack, CEO assures funds safe
5 articles · September 28, 2026
- cryptopolitan.comCircle and Tether froze about $318,000 in USDC and USDT linked to the Bitget hack, but the attacker had already swapped most of the breach, now estimated at roughly $387.5 million, into Ether and other assets issuers cannot touch.
1 article · September 25, 2026
- cryptoslate.comBitget hit by $351.6 million breach days before 8th anniversary
4 articles · September 25, 2026
- decrypt.coBitget 'Potentially Hacked' as $183 Million Vanishes From Exchange Wallets
3 articles · September 25, 2026
- finance.yahoo.comBitget Hacked as $350 Million Vanishes From Crypto Exchange Wallets
2 articles · September 25, 2026
- fortune.comNorth Korea accused of plundering Bitget for $387 million in year’s biggest crypto attack
2 articles · September 25, 2026
- pymnts.comBitget Suffers Year’s Largest Crypto Hack as Losses Top $387 Million
2 articles · September 25, 2026
- qz.comBitget hacked for $352 million, suspects North Korea
1 article · September 25, 2026
- unchainedcrypto.comBitget's Hot and Cold Wallets Hit in Suspected Hack Worth More Than $180 Million - Unchained
1 article · September 24, 2026
Topics and entities
Topics
- Crypto laundering and tracing
- Stablecoin freezes and seizures
- Crypto Exchange Security Operations