News linked to both this project and an event.
According to monitoring by @ai_9684xtpa, after Bitget resumed ETH withdrawals, ETH quickly flowed back, even registering net inflows. The address beginning with 0xED9 appears to be the hot wallet prepared by Bitget for these withdrawal requests. It held a balance of 30,000 ETH prior to the resumption, experienced steady outflows over the following 30 minutes that temporarily drove it down to approximately 25,000 ETH, but subsequent ETH inflows have since pushed the current balance back above 30,000 ETH.
According to on-chain analyst Ai Yi's monitoring, after Bitget opened ETH withdrawals, the ETH balance of a suspected Bitget ETH withdrawal hot wallet (0xED9…18771) dropped from 30,000 ETH to approximately 25,000 ETH within half an hour, followed by ETH inflows. The balance is currently slightly higher than before withdrawals were opened.
MistTrack monitoring indicates that a Bitget attacker recently attempted to transfer stolen funds through the cross-chain liquidity network Chainflip, but the deposit was rejected by the relevant broker (Broker). The platform did not freeze the funds, but instead executed a return to the originating address. MistTrack stated it will continue to track the subsequent flow of the stolen funds.
according to on-chain analyst Ai Yi's monitoring, of the 5,500 BTC originally held by Bitget's BTC Protection Fund, 3,215.28 BTC has now flowed out, worth approximately $266 million, with 2,284.71 BTC remaining on-chain.Ai Yi stated that approximately 13 hours have passed since the most recent Bitget hot wallet transfer, and the first wave of BTC withdrawal demand has likely been largely processed. Future attention can be directed toward ETH withdrawal activity.
Odaily reports: According to on-chain analyst Ai Yi's monitoring, as of 16:39, a cumulative total of 3,298.7 BTC has been withdrawn from Bitget. The platform has processed 6,875 withdrawal transactions, with another 3,580 withdrawal transactions awaiting on-chain block confirmations. Bitget has newly opened a BSC network BTC withdrawal channel. The related information was disclosed and confirmed by GracyBitget and xiejiayinBitget during a livestream.
Odaily News: According to on-chain analyst Ai Yi's monitoring, Bitget's BTC withdrawal portal has been opened. A total of 5,500 BTC from the protection fund has been transferred to Bitget's hot wallet in batches to meet withdrawal demand, of which 2,042.28 BTC, approximately $169 million, has completed the transfer, with 3,457.72 BTC remaining on-chain. This portion of funds was transferred in advance and does not equate to the actual withdrawal amount. GracyBitget and xiejiayinBitget have committed to continuously replenishing the fund to the $300 million baseline within one week.
Odaily News: According to on-chain analyst Yu Jin, over 90% of the funds swapped cross-chain through THORChain are illicit or grey-market funds. Yu Jin stated that most of the funds stolen from Bybit last year were transferred through THORChain, which collected nearly $10 million in fees within 10 days. Recently, some of the funds stolen from Bitget have also been transferred through THORChain, generating $1 million in fee revenue.
On-chain analyst Ai Yi announced that Bitget has published its withdrawal plan, resuming phased withdrawals starting at 16:00 on September 28 in the order of BTC, ETH, USD, and other tokens. Analysts note that since the protection funds consist entirely of BTC, this indirectly encourages users eager to withdraw to convert their tokens to BTC independently, allowing the platform to bypass the token-selling step to cover payouts. It remains to be seen whether a slight premium for BTC will develop within the exchange.
Odaily news: According to Lookonchain monitoring, about 11 hours ago, an address withdrew 257.6 ETH, worth $692,000, and 545,000 USDT from Binance, then swapped 545,000 USDT for 200.2 ETH. About 1 hour ago, the address transferred all 457.9 ETH, worth $1.23 million, into the Bitget hacker wallet.
Odaily reports: Xie Jiaxin posted on X stating that this Bitget security incident involved multiple non-EVM chains and 10 tokens, and due to the different method of asset theft, different approaches to handling and restoring withdrawals were taken compared to last year's Bybit security incident in order to thoroughly eliminate potential risks.Additionally, Xie Jiaxin stated that he and Bitget CEO Gracy Chen will host a community livestream 30 minutes before withdrawals resume on Monday to discuss this security incident and answer community questions.Bitget announced on X that it will restore withdrawals in phases: Bitcoin network withdrawals will resume on September 28 at 8:00 (UTC); ETH withdrawals on Ethereum, BSC, Arbitrum, Base, and Optimism networks will resume on September 29 at 8:00 (UTC); USDT withdrawals on Ethereum, BSC, Solana, and Tron networks will resume on September 30 at 8:00 (UTC); other tokens, fiat, and P2P withdrawals will resume on October 2 at 8:00 (UTC). Trading and deposit services continue to operate normally, and users do not need to take any action in advance.
Odaily News: Bitget posted on X platform that the vulnerability involved in the September 24 security incident has been identified and fixed. The team is conducting additional verification and security checks on the withdrawal infrastructure, with Mandiant and SlowMist continuing to assist with the investigation. The temporary suspension of withdrawals is a security measure and is unrelated to the availability of user assets; user account balances have not been affected, and the Bitget Protection Fund will cover the financial impact of this platform-wide incident.Bitget plans to resume withdrawals in phases: Bitcoin network withdrawals will resume on September 28 at 8:00 (UTC); ETH withdrawals on the Ethereum, BSC, Arbitrum, Base, and Optimism networks will resume on September 29 at 8:00 (UTC); USDT withdrawals on the Ethereum, BSC, Solana, and Tron networks will resume on September 30 at 8:00 (UTC); other tokens, fiat, and P2P withdrawals will resume on October 2 at 8:00 (UTC). Trading and deposit services continue to operate, and users do not need to take any action in advance.
DOG 创始人 Leonidas在 X 平台发文喊话 Bitget CEO 称，Bitget 在遭遇黑客攻击数小时后、用户提现仍处于暂停状态时发布 DOG 下架公告，叠加黑客事件引发的信任担忧，导致 DOG在 Bitget 出现严重价格脱锚，并直接影响持有或交易 DOG 的用户。
Bitget CEO Gray Chen posted on X platform that following the security incident, on-chain tracking confirmed the attacker's address received a total of $387.5 million in assets, revised upward from the previously disclosed $351.6 million.Gray Chen stated that the revised amount incorporates Zcash and TRON assets that were not fully accounted for previously, and does not represent newly stolen funds. No unauthorized transfers have occurred since the incident, and the situation remains under control. Bitget has launched a Recovery Bounty Program, offering a 5% bounty to each party that voluntarily assists in freezing the attacker's funds or recovering the funds. The exchange has also launched a real-time tracking dashboard, an information submission portal, and an attacker address API, while supporting reports submitted through Bybit's Lazarus Bounty platform. Bitget is currently making full preparations to resume withdrawals, with a specific withdrawal plan to be announced before 4:00 AM (UTC) on September 26.
According to on-chain detective SomaXBT, Circle has frozen 99,989.91 USDC in an address associated with the Bitget hacker, while approximately 218,000 USDT at the same address remains unfrozen. According to prior on-chain tracking, this address shares a multi-hop fund connection with Bitget's initial stolen funds address. The transferred USDC and USDT remained inactive for over 2.5 hours. The community had previously publicly called on Circle and Tether to freeze the relevant assets. Circle has now taken the lead in executing the action, and SomaXBT subsequently urged Tether to follow suit.
on-chain analyst tanuki42 disclosed that address 0xe07 holds 100,000 USDC and 218,000 USDT originating from the initial address of the stolen Bitget funds. These funds had been dormant for over 2.5 hours before the analyst publicly called on Circle and Tether to freeze the assets. At around 5 PM, crypto researcher SomaXBT posted that Circle had frozen the USDC assets and called on Tether to follow suit. As of press time, Tether has yet to respond.
Bitget CEO Gracy Chen 发布安全事件最新进展称，平台正与独立第三方安全团队 Mandiant 和慢雾合作，对此次事件展开全面调查。 Gracy Chen 表示，目前用户账户余额保持完整，此次平台层面安全事件造成的影响将由 Bitget 用户保护基金覆盖；Bitget Wallet 采用自托管模式，其基础设施与 Bitget Exchange 相互独立，因此未受到此次事件影响。 目前 Bitget Exchange 的充值、交易及奖励等功能继续运行，但提币仍暂时暂停，平台正在进行额外安全核查，确认安全后将恢复。Bitget 官方公告也显示，提币服务目前仍处于暂停状态，充值和交易正常运行。 Bitget 表示，后续调查进展及安全事件相关信息将通过官方渠道持续公布。
Bitget CEO Gracy Chen posted a 12-hour progress report on the security incident on X, including:1. Affected assets include ETH, XRP (largest single-chain loss), BNB, AVAX, USDT, USDC, and other tokens. Affected chains include: Ethereum, XRP Ledger, Arbitrum, Avalanche, Optimism, BSC, and Base. All on-chain cold wallets have been confirmed secure and unaffected.2. All foundations of the affected chains have been contacted, and some foundations have confirmed the freezing of the hacker's wallet addresses.3. Based on IP behavioral characteristics and on-chain analysis, the attack methodology is highly consistent with known patterns of North Korean hacker groups. Relevant authorities have been notified, and full cooperation is being provided for a global investigation.4. Bitget Wallet (decentralized wallet) operates completely independently from Bitget exchange infrastructure, and this incident has no impact on it. Bitget Wallet assets are completely safe.5. Transparent disclosure regarding the platform's financial status: In addition to over $464 million in protection funds (all held in publicly verifiable wallet addresses), Bitget's own assets exceed $1 billion. User funds are covered at a 1:1 ratio, and all data can be verified on-chain.6. Regarding withdrawal recovery timing: The goal is to achieve full recovery as soon as possible. Once a specific time window is confirmed, an announcement will be made immediately. No commitment will be made to timelines that cannot be fulfilled.
on-chain analyst Yu Jin has monitored that the $464 million risk protection fund Bitget claims can cover stolen assets is a total of 5,500 BTC, distributed across 3 wallet addresses.
Odaily reports: On-chain analyst Specter has stated that they have established an on-chain connection between the Bitget attack and the AFX attack that occurred in July of this year. The latter involved approximately $24 million in stolen funds and was attributed to TraderTraitor.Specter claims that the XRP stolen from Bitget can be directly traced to the stolen funds from the AFX attack after being bridged across chains, leading them to believe that this attack may be related to Lazarus Group. The attribution is still pending further verification.
According to Bitcoin News monitoring, $176 million worth of ETH and USDT0 was transferred from multiple Bitget wallets to a single address, in what appears to be unauthorized activity. This suspected hack did not involve Bitcoin. Bitget has not yet commented.