Update, 6:20 p.m. ET: Bitget CEO Gracy Chen said on X that the exchange detected unauthorized transfers from some of its hot and warm wallets at 2:31 p.m. ET, affecting about $351.6 million. She said cold wallets remain secure, withdrawals are paused, and Bitget’s User Protection Fund, which holds more than $464 million, covers the full loss.

Crypto exchange Bitget appears to have suffered a major, still ongoing, wallet breach on Thursday afternoon. A newly created address pulled more than $180 million in crypto out of wallets labeled as Bitget’s between 2:31 p.m. and 4:55 p.m. ET, onchain records show. Etherscan now tags the receiving address as Bitget Exploiter 1.

As of 5 p.m. ET, Bitget had not issued a public statement. Unchained has reached out to Bitget for comment. Several users on X said their withdrawals were stuck in review.

How the Funds Moved

The first transfer, a 0.84 ETH test, reached the new address at 2:31 p.m. ET from a hot wallet Etherscan labels Bitget 6. Within 30 minutes, the same address received about $34.75 million in USDT, $12.85 million in USDC and 3,000 XAUT, Tether’s tokenized gold, worth roughly $12.8 million.

Over the next hour it collected 24,373 ETH, about $65 million, from Bitget 6 and a second wallet labeled Bitget 35. Bitget 35 also sent it 821,012 AVAX, worth about $8.5 million, on Avalanche.

The stablecoins and gold tokens then went to a second address and were swapped into about 22,600 ETH over roughly 40 minutes. Tether and Circle can freeze USDT and USDC; no issuer can freeze ETH.

The outflows had not fully stopped by late afternoon. At 4:55 p.m. ET, Bitget 6 sent another 8.2 million USDC to the address on Avalanche, where it still sat minutes later.

By 5 p.m. ET, about 48,800 ETH, roughly $131 million, sat across four addresses Etherscan tags as Bitget exploiters. An Arkham tracker built by a user grouping 13 linked addresses shows about $183.8 million arriving from Bitget wallets across six networks, including Arbitrum and BNB Chain. The same tracker shows funds moving between chains through bridges such as Stargate and Celer’s cBridge.

A Possible XRP Leg

The total may be larger. At 3:01 p.m. and 3:16 p.m. ET, the same minutes as two of the Ethereum transfers, two XRP Ledger wallets that XRPScan labels as Bitget’s sent 93.7 million XRP, about $143 million, to a fresh address. No explorer has tagged that address as an exploiter, and Unchained could not confirm it belongs to the same actor.

Onchain analysts on X also reported that 19.67 million USDT0 left a Bitget hot wallet on Arbitrum and was swapped for about 7,111 ETH, which Unchained could not independently verify.

It is not yet known how the wallets were accessed or whether customer balances are affected. The incident comes 19 months after North Korea’s Lazarus Group stole $1.5 billion from Bybit in February 2025.

Related Listen: The Chopping Block: ColdCard’s $100M RNG Hack, AI-Powered Security & Ethereum’s Staking Yield Taper