Bitget Exploit: How $387.5 Million Was Stolen and Where the Funds Went

On September 24, 2026, cryptocurrency exchange Bitget suffered a major security breach in which attackers stole approximately $387.5 million in crypto assets. The attackers gained access to the exchange's internal infrastructure and initiated unauthorized transfers from its hot and warm wallets.

Key details of the attack:

• Affected platform: Bitget
• Date of the attack: September 24, 2026
• Total losses: $387.5 million (approximately $388 million)
• Affected networks: Ethereum, XRP Ledger, Zcash, TRON, and others
• Attack began: 18:31 UTC
• Detection: 19:05 UTC, after which withdrawals were blocked
• Cause: Exploitation of a vulnerability in a third-party security product, followed by unauthorized privileged access to internal systems

Bitget's cold wallets were not affected. The initial loss estimate was $351.6 million, but it was revised upward on September 25 after additional stolen assets were identified on the Zcash and TRON networks.

The attack began with the compromise of a third-party security tool used by Bitget. The hackers exploited a previously unknown vulnerability (a zero-day), gained access to the exchange's internal systems, and eventually reached the infrastructure responsible for managing cryptocurrency wallets.

This allowed them to submit withdrawal instructions that the system treated as legitimate transactions. As a result, the attackers were able to transfer cryptocurrency to addresses under their control while bypassing the exchange's security mechanisms.

However, the wallets' private keys were not stolen. The attackers gained control over the system responsible for managing transfers, rather than the private keys themselves. Bitget's cold wallets, which held most of the exchange's reserves, remained unaffected.

On September 30, independent reports by SlowMist and Mandiant were published. The investigators found that the attackers had compromised two third-party security products and used them to gain access to a server responsible for wallet operations. The names of these products were not disclosed in the published reports.

Initial Addresses Used by the Attackers

While tracing the stolen funds, Bitget publicly identified four primary addresses that received assets following the attack:

These addresses served as starting points for tracing the stolen funds. The attackers later began transferring cryptocurrency to other wallets, swapping it for different assets, and moving it between blockchains. Therefore, the table includes only the first known addresses, rather than every wallet involved in the scheme.
The subsequent movement of the stolen assets, particularly on the Ethereum network, is the primary focus of our investigation.

The laundering of the stolen assets began almost immediately after the attack on Bitget. Instead of keeping the funds at the initial addresses, the attackers started swapping them, distributing them across new wallets, and transferring them between different blockchain networks.

Ethereum became one of the main destinations for the stolen funds. The attackers moved cryptocurrency from other blockchains, including TRON, into Ethereum. They then distributed the assets across numerous wallets and used specialized services to swap them for Bitcoin. This approach helped obscure the transaction trails and made the stolen funds more difficult to trace.

However, not all stolen funds passed through Ethereum. For example, most of the stolen XRP was swapped directly from XRP Ledger into BTC, while a portion of the stolen ZEC was transferred into Zcash's shielded pool.

Ethereum: Asset Consolidation and Distribution

Almost immediately after withdrawing funds from Bitget, the attackers began converting the stolen assets. Their first priority was to swap USDT, USDC, and XAUt, which could potentially be frozen by their issuers. To do this, they used decentralized exchanges, including Uniswap. According to BlockSec, most of these swaps were completed within the first 40 minutes after the funds were withdrawn.

At the same time, assets from Arbitrum, Base, Optimism, and other EVM-compatible networks were transferred to Ethereum through cross-chain bridges. As a result, the attackers managed to consolidate approximately 68,295 ETH, which had been distributed among eight consolidation wallets by September 25. Six of these wallets initially received 10,000 ETH each.

The next stage began on September 27, when funds from the consolidation wallets started moving to numerous new addresses. According to Bitquery, by September 29, the movement of assets from seven consolidation wallets had been traced through 409 new addresses.

The main destinations for the subsequent transfers were the cross-chain protocols THORChain and Chainflip, which allow assets to be exchanged between different blockchains, including converting ETH into native Bitcoin without using centralized exchanges.

As part of our own on-chain investigation of the Ethereum network, we also identified substantial transfers to addresses associated with these services:

• THORChain: approximately $118.08 million across 2,215 transactions.
• Chainflip: approximately $9.17 million across 102 transactions.

The total recorded transfer volume reached $127.24 million, with more than 92% going through THORChain. These figures were calculated based on the transaction connections shown in our graph and represent incoming transfers to the services, rather than necessarily the unique amount of assets ultimately laundered.
Ethereum therefore became one of the key hubs for consolidating and redistributing the stolen funds.

Through numerous intermediary wallets, the attackers routed assets into cross-chain protocols, where a significant portion was subsequently converted into Bitcoin.

TRON: Rapid Movement of Funds Through Ethereum

On the TRON network, the attackers also began moving funds almost immediately after the attack. By September 25, the initial attacker-controlled address had been almost completely emptied.

A total of approximately 20.59 million TRX was withdrawn from this address across 22 transactions. Most of the assets were converted into USDT and then transferred to Ethereum through the USDT0 cross-chain infrastructure.

Our analysis of fund movements on TRON confirms that Ethereum was one of the main destinations for subsequent asset transfers. Unlike the consolidation-wallet strategy used on Ethereum, funds on TRON generally did not remain at the initial address for long and were quickly moved to other networks.
After reaching Ethereum, some of the assets were sent to THORChain and Chainflip for conversion into Bitcoin.

However, the attackers did not rely exclusively on direct routes. According to Bitquery, some funds passed through Umbra, a service that allows assets to be sent to one-time addresses. The funds then moved between Ethereum and Arbitrum before reaching Chainflip. This route alone resulted in payouts totaling 21.65 BTC, distributed among five Bitcoin wallets.

TRON therefore primarily served as a starting point for moving the stolen assets, while Ethereum was used for their consolidation, distribution, and subsequent conversion through cross-chain protocols.

XRP Ledger: Swapping Funds Through THORChain

Unlike the stolen assets on Ethereum and TRON, the stolen XRP did not generally require intermediate consolidation on Ethereum.

After withdrawing the funds from Bitget, the attackers distributed approximately 102.98 million XRP among several addresses and then gradually began sending the assets to THORChain.

This protocol enables swaps between native assets on different blockchains without first transferring them to Ethereum.

By September 27, the initial XRP wallets had been emptied. According to Bitquery's analysis, approximately 93.22 million XRP, or 90.5% of the stolen amount, was swapped for Bitcoin. Another 7.86 million XRP was converted into ETH, while smaller amounts were exchanged for BNB and other assets.

As a result, the primary route for the largest individual portion of the stolen funds was a direct XRP-to-BTC swap without using Ethereum as an intermediary.

Zcash: Transfers Into the Shielded Pool

A separate route was identified on the Zcash network, where the attackers received approximately 18,916 ZEC.

Initially, most of these assets remained at an attacker-controlled address. However, starting on September 25, transfers to additional wallets began, after which funds were sent into the Ironwood shielded pool.
By September 30, approximately 3,259 ZEC had been transferred into the shielded pool, while around 15,657 ZEC remained at the initial address.

Unlike transparent Zcash transactions, transactions within the shielded pool conceal information about senders, recipients, and transaction amounts. As a result, once funds enter this infrastructure, tracing their subsequent movement using standard on-chain analysis methods becomes significantly more difficult.

Zcash: Transfers Into the Shielded Pool

A separate route was identified on the Zcash network, where the attackers received approximately 18,916 ZEC.

Initially, most of these assets remained at an attacker-controlled address. However, starting on September 25, transfers to additional wallets began, after which funds were sent into the Ironwood shielded pool.
By September 30, approximately 3,259 ZEC had been transferred into the shielded pool, while around 15,657 ZEC remained at the initial address.

Unlike transparent Zcash transactions, transactions within the shielded pool conceal information about senders, recipients, and transaction amounts. As a result, once funds enter this infrastructure, tracing their subsequent movement using standard on-chain analysis methods becomes significantly more difficult.

BNB Chain and Other Networks

Assets stolen on BNB Chain were also actively swapped and transferred through various protocols. In particular, approximately 12,719 BNB was distributed among additional addresses, after which a significant portion was routed through THORChain for conversion into Bitcoin.
On Arbitrum, Base, Optimism, and Avalanche, the attackers primarily used cross-chain bridges to transfer assets into Ethereum.
Several infrastructure solutions were involved in these operations, including Across, Stargate, and Circle CCTP.
However, the involvement of these protocols in the fund movements does not mean that they were compromised. The attackers used existing infrastructure for token swaps and cross-chain transfers.

Bitcoin: The Final Stage of Money Laundering

Despite differences in the initial routes, a significant portion of the assets stolen from Bitget was eventually converted into Bitcoin.
The main tools used for this purpose were the cross-chain protocols THORChain and Chainflip, which allowed the attackers to swap ETH, XRP, and other assets for BTC without relying on centralized exchanges.
According to BlockSec, by September 29, approximately $269 million in funds linked to the attack had passed through THORChain, while around $37.27 million had passed through Chainflip. These figures represent protocol transaction volumes and may include repeated movements of the same assets.

Further investigation by CipherOwl identified specific Bitcoin addresses that received funds following swaps through THORChain. Analysts identified 36 BTC addresses that collectively received approximately 1,238.49 BTC along the traced ETH → THORChain → BTC route.

The five largest recipient addresses identified in the investigation are listed below:

The first address, bc1qh2ml...64g7pf, attracted particular attention. Researchers established that it received BTC originating from swaps involving both stolen ETH and stolen XRP. This finding made it possible to connect two previously separate fund movement routes.

Bitcoin from this address was subsequently distributed across 14 additional consolidation addresses before being transferred to new wallets. The identified recipients included:

Some routes also passed through Chainflip. According to Bitquery, one swap involving 2,450 ETH resulted in a payout of 74.46 BTC to a single Bitcoin address.

In addition, the previously discussed route originating on TRON and passing through Umbra, Arbitrum, and Chainflip resulted in payouts totaling 21.65 BTC, distributed among five wallets.

At the next stage, the attackers began using tools designed to make transaction relationships more difficult to establish. In particular, some Bitcoin was sent through CoinJoin transactions, which combine inputs and outputs from multiple participants.

By September 29, BlockSec estimated that approximately $3.94 million in funds associated with the attack had passed through CoinJoin.

The final stage of the laundering process therefore involved converting the stolen assets into BTC, distributing them across numerous addresses, consolidating them again, and using privacy-enhancing tools.
Nevertheless, traces of certain routes remained visible. Bitcoin transaction analysis made it possible to link funds originally stolen from different blockchain networks.

The Bitget exploit became one of the largest cryptocurrency hacks of 2026, with attackers stealing approximately $387.5 million. The incident demonstrated that vulnerabilities in internal infrastructure can lead to substantial financial losses even when wallet private keys remain uncompromised.

The subsequent movement of the stolen assets highlighted the complexity of modern cryptocurrency money-laundering schemes. The attackers used multiple blockchain networks, numerous intermediary wallets, and cross-chain protocols to convert and distribute the stolen funds.

The Bitget exploit clearly demonstrates that transferring assets between blockchains does not guarantee that their origins will remain hidden. Despite the use of cross-chain protocols, intermediary wallets, and privacy-enhancing tools, a significant portion of the fund movement routes remains traceable through on-chain analysis.

At the same time, the published findings reflect only the transaction relationships identified at the time of the investigation. The subsequent movement of the funds and the ultimate recipients of some of the stolen assets remain under investigation.