{"id":13700,"date":"2026-09-25T06:31:57","date_gmt":"2026-09-25T06:31:57","guid":{"rendered":"https:\/\/cryptonews.uk.com\/?p=13700"},"modified":"2026-09-25T06:31:57","modified_gmt":"2026-09-25T06:31:57","slug":"bitget-hit-by-351-6m-hot-wallet-attack-despite-nearly-3-hour-transfer-window","status":"publish","type":"post","link":"https:\/\/cryptonews.uk.com\/?p=13700","title":{"rendered":"Bitget Hit by $351.6M Hot-Wallet Attack Despite Nearly 3-Hour Transfer Window"},"content":{"rendered":"<p><\/p>\n<div>\n<div id=\"blockquote-block_1a597846d28c9567066c3c3e44415b7d\" class=\"blockquote-container\" style=\"border-color: #5100fc\">\n<div class=\"blockquote-text\">\n<ul>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Bitget detected suspicious transactions involving its hot and warm wallets, with US$351.6 million transferred without authorisation.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">The exchange says cold wallets and user funds remain secure, while withdrawals are suspended during its security review.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">On-chain analysis traced multiple large transfers across Ethereum, Arbitrum and other networks, with funds continuing to move after Bitget\u2019s public notice.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Scammers have already created spoofed tokens and near-identical wallet addresses, posing a risk to people copying transaction details from block explorers.<\/span><\/li>\n<\/ul>\n<\/div>\n<\/div>\n<p class=\"wp-block-paragraph\">In the early hours of Friday, Seychelles-registered crypto exchange Bitget experienced what it calls a hot wallet incident. At 4:31 am AEST (UTC+10) on 25 September, the security systems of the AUSTRAC-registered exchange detected some suspicious transactions. CEO Gracy Chen put out a notice on X saying their emergency response team had been activated. In total, US$351.6 million (AU$501.48 million) has left the exchange in these unauthorised transactions.<\/p>\n<figure class=\"wp-block-embed is-type-rich is-provider-x wp-block-embed-x\"\/>\n<p class=\"wp-block-paragraph\">Chen said that only hot and warm wallets were affected and that cold wallets \u201cremain fully secure\u201d, while user funds remain untouched. Withdrawals have been suspended for all users while the exchange carries out a security review, though deposits and trading continue as normal.<\/p>\n<div id=\"blockquote-block_58e597bc37ee46460e89f27e7a8cdede\" class=\"blockquote-container variant-personal\">\n<div class=\"blockquote-text\">\n<p>User funds are safe. The full amount of this loss falls within the coverage of Bitget\u2019s User Protection Fund, which currently holds over $464 million.<\/p>\n<\/div>\n<div class=\"blockquote-attribution\">\n        <img decoding=\"async\" class=\"author-image lazyload\" src=\"https:\/\/cdn.cryptonews.com.au\/2025\/04\/21130045\/Bitget-CEO-Gracy-Chen.png\"\/><img decoding=\"async\" src=\"https:\/\/cdn.cryptonews.com.au\/2025\/04\/21130045\/Bitget-CEO-Gracy-Chen.png\" class=\"author-image\" data-eio=\"l\"\/>        Gracy Chen, Bitget CEO    <\/div>\n<\/div>\n<p class=\"wp-block-paragraph\">She added that authorities have been informed and the team is working to establish what caused the incident, with a full report promised within 24 hours. However, Chen stopped short of calling this a hack, saying they wouldn\u2019t \u201cspeculate on the attack vector until the investigation is complete\u201d.<\/p>\n<p class=\"wp-block-paragraph\"><strong>Read also:<\/strong><strong> <\/strong><strong>Bitcoin Hits $87K, Pulls Back to $84K as Market Weighs Next Move\u00a0<\/strong><\/p>\n<h2 id=\"h-how-things-went-down\" class=\"wp-block-heading\">How Things Went Down<\/h2>\n<p class=\"wp-block-paragraph\">A Forbes\u2019 on-chain analysis found that a wallet tagged \u201cBitget 6\u201d moved a fraction of an ether to a brand-new address at 4:31:11 am AEST \u2013 a pattern security researchers typically read as a dry run ahead of a bigger withdrawal. Oddly, that\u2019s the exact minute Bitget\u2019s own systems reportedly picked up the incident.<\/p>\n<p class=\"wp-block-paragraph\">Larger transfers followed quickly: tens of millions of USDT roughly 27 minutes later, followed by USDT0 on Arbitrum, USDC and additional ether within the same few minutes. A second wallet, \u201cBitget 35\u201d, moved thousands more in ether across three transfers.<\/p>\n<p class=\"wp-block-paragraph\">Money kept moving well after that: a further tranche of ether was funnelled into three previously unused wallets at 6:13 am, 6:19 am and 7:41:11 am AEST \u2013 that last transfer landing roughly 11 minutes after Bitget\u2019s public notice went live at 7:30 am AEST. An earlier transfer at 7:23:11 am AEST, just seven minutes before the notice, was close to the final large movement but wasn\u2019t the last one recorded.<\/p>\n<p class=\"wp-block-paragraph\">According to Forbes\u2019 figures, Ethereum and Arbitrum together accounted for over US$130 million (A$185.37 million) of the losses, plus a separate haul of several million dollars in a gold-backed stablecoin. The remaining balance of the US$351.6 million was spread across additional chains Forbes did not itemise in full.<\/p>\n<p class=\"wp-block-paragraph\"><strong>Read more:<\/strong><strong> <\/strong><strong>Trump Discloses Up to $100,000 Purchase of Strategy Shares<\/strong><\/p>\n<p class=\"wp-block-paragraph\">The choice of assets is interesting, as some stablecoins can be frozen, while ETH itself cannot be frozen by an issuer. The attacker was quick to sell out of freezable assets, reportedly paying a premium to do so, according to pseudonymous sleuth DCF GOD.<\/p>\n<figure class=\"wp-block-embed is-type-rich is-provider-x wp-block-embed-x\"\/>\n<h2 id=\"h-a-word-of-caution\" class=\"wp-block-heading\">A Word of Caution<\/h2>\n<p class=\"wp-block-paragraph\">Forbes also warned that scammers have already hijacked the incident and are trying to take advantage. Within hours, fake ETH, USDC and USDT tokens began mirroring the attacker\u2019s transfers, using hidden characters and near-identical wallet addresses to appear legitimate. Fourteen spoofed transactions had appeared by 8:00 am AEST, creating a risk for anyone copying addresses directly from a block explorer.<\/p>\n<\/p><\/div>\n<p>Bitget,Crypto Attack#Bitget #Hit #351.6M #HotWallet #Attack #3Hour #Transfer #Window1790317917<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Bitget detected suspicious transactions involving its hot and warm wallets, with US$351.6 million transferred without authorisation. The exchange says cold wallets and user funds remain secure, while withdrawals are suspended during its security review. On-chain analysis traced multiple large transfers across Ethereum, Arbitrum and other networks, with funds continuing to move after Bitget\u2019s public notice.<\/p>\n","protected":false},"author":1,"featured_media":13701,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[7],"tags":[7121,7123,1280,3975,114,7122,810,1817],"class_list":["post-13700","post","type-post","status-publish","format-standard","has-post-thumbnail","category-bitcoin","tag-351-6m","tag-3hour","tag-attack","tag-bitget","tag-hit","tag-hotwallet","tag-transfer","tag-window"],"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v26.6 (Yoast SEO v26.6) - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Bitget Hit by $351.6M Hot-Wallet Attack Despite Nearly 3-Hour Transfer Window - Crypto News: Latest Cryptocurrency News and Analysis<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/cryptonews.uk.com\/?p=13700\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Bitget Hit by $351.6M Hot-Wallet Attack Despite Nearly 3-Hour Transfer Window\" \/>\n<meta property=\"og:description\" content=\"Bitget detected suspicious transactions involving its hot and warm wallets, with US$351.6 million transferred without authorisation. The exchange says cold wallets and user funds remain secure, while withdrawals are suspended during its security review. On-chain analysis traced multiple large transfers across Ethereum, Arbitrum and other networks, with funds continuing to move after Bitget\u2019s public notice.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/cryptonews.uk.com\/?p=13700\" \/>\n<meta property=\"og:site_name\" content=\"Crypto News: Latest Cryptocurrency News and Analysis\" \/>\n<meta property=\"article:published_time\" content=\"2026-09-25T06:31:57+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/cdn.cryptonews.com.au\/2025\/04\/21130045\/Bitget-CEO-Gracy-Chen.png\" \/>\n<meta name=\"author\" content=\"\u884c\u653f\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"\u884c\u653f\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/cryptonews.uk.com\/?p=13700\",\"url\":\"https:\/\/cryptonews.uk.com\/?p=13700\",\"name\":\"Bitget Hit by $351.6M Hot-Wallet Attack Despite Nearly 3-Hour Transfer Window - Crypto News: Latest Cryptocurrency News and Analysis\",\"isPartOf\":{\"@id\":\"https:\/\/cryptonews.uk.com\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/cryptonews.uk.com\/?p=13700#primaryimage\"},\"image\":{\"@id\":\"https:\/\/cryptonews.uk.com\/?p=13700#primaryimage\"},\"thumbnailUrl\":\"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/09\/bitget-crypto-attack.jpg\",\"datePublished\":\"2026-09-25T06:31:57+00:00\",\"author\":{\"@id\":\"https:\/\/cryptonews.uk.com\/#\/schema\/person\/822778c5844e0d16d43dce6630f4f1bf\"},\"breadcrumb\":{\"@id\":\"https:\/\/cryptonews.uk.com\/?p=13700#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/cryptonews.uk.com\/?p=13700\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/cryptonews.uk.com\/?p=13700#primaryimage\",\"url\":\"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/09\/bitget-crypto-attack.jpg\",\"contentUrl\":\"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/09\/bitget-crypto-attack.jpg\",\"width\":1920,\"height\":1080},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/cryptonews.uk.com\/?p=13700#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/cryptonews.uk.com\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Bitget Hit by $351.6M Hot-Wallet Attack Despite Nearly 3-Hour Transfer Window\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/cryptonews.uk.com\/#website\",\"url\":\"https:\/\/cryptonews.uk.com\/\",\"name\":\"Crypto News: Latest Cryptocurrency News and Analysis\",\"description\":\"Latest Crypto &amp; Bitcoin News\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/cryptonews.uk.com\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/cryptonews.uk.com\/#\/schema\/person\/822778c5844e0d16d43dce6630f4f1bf\",\"name\":\"\u884c\u653f\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/cryptonews.uk.com\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/e4c2d23409b09e004cef3facbe677e95c5401f9e29680f3a311e0130c5748089?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/e4c2d23409b09e004cef3facbe677e95c5401f9e29680f3a311e0130c5748089?s=96&d=mm&r=g\",\"caption\":\"\u884c\u653f\"},\"sameAs\":[\"http:\/\/demo3.aiwalls.com\/coinbase\"],\"url\":\"https:\/\/cryptonews.uk.com\/?author=1\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Bitget Hit by $351.6M Hot-Wallet Attack Despite Nearly 3-Hour Transfer Window - Crypto News: Latest Cryptocurrency News and Analysis","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/cryptonews.uk.com\/?p=13700","og_locale":"en_US","og_type":"article","og_title":"Bitget Hit by $351.6M Hot-Wallet Attack Despite Nearly 3-Hour Transfer Window","og_description":"Bitget detected suspicious transactions involving its hot and warm wallets, with US$351.6 million transferred without authorisation. The exchange says cold wallets and user funds remain secure, while withdrawals are suspended during its security review. On-chain analysis traced multiple large transfers across Ethereum, Arbitrum and other networks, with funds continuing to move after Bitget\u2019s public notice.","og_url":"https:\/\/cryptonews.uk.com\/?p=13700","og_site_name":"Crypto News: Latest Cryptocurrency News and Analysis","article_published_time":"2026-09-25T06:31:57+00:00","og_image":[{"url":"https:\/\/cdn.cryptonews.com.au\/2025\/04\/21130045\/Bitget-CEO-Gracy-Chen.png","type":"","width":"","height":""}],"author":"\u884c\u653f","twitter_card":"summary_large_image","twitter_misc":{"Written by":"\u884c\u653f","Est. reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/cryptonews.uk.com\/?p=13700","url":"https:\/\/cryptonews.uk.com\/?p=13700","name":"Bitget Hit by $351.6M Hot-Wallet Attack Despite Nearly 3-Hour Transfer Window - Crypto News: Latest Cryptocurrency News and Analysis","isPartOf":{"@id":"https:\/\/cryptonews.uk.com\/#website"},"primaryImageOfPage":{"@id":"https:\/\/cryptonews.uk.com\/?p=13700#primaryimage"},"image":{"@id":"https:\/\/cryptonews.uk.com\/?p=13700#primaryimage"},"thumbnailUrl":"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/09\/bitget-crypto-attack.jpg","datePublished":"2026-09-25T06:31:57+00:00","author":{"@id":"https:\/\/cryptonews.uk.com\/#\/schema\/person\/822778c5844e0d16d43dce6630f4f1bf"},"breadcrumb":{"@id":"https:\/\/cryptonews.uk.com\/?p=13700#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/cryptonews.uk.com\/?p=13700"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/cryptonews.uk.com\/?p=13700#primaryimage","url":"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/09\/bitget-crypto-attack.jpg","contentUrl":"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/09\/bitget-crypto-attack.jpg","width":1920,"height":1080},{"@type":"BreadcrumbList","@id":"https:\/\/cryptonews.uk.com\/?p=13700#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/cryptonews.uk.com\/"},{"@type":"ListItem","position":2,"name":"Bitget Hit by $351.6M Hot-Wallet Attack Despite Nearly 3-Hour Transfer Window"}]},{"@type":"WebSite","@id":"https:\/\/cryptonews.uk.com\/#website","url":"https:\/\/cryptonews.uk.com\/","name":"Crypto News: Latest Cryptocurrency News and Analysis","description":"Latest Crypto &amp; Bitcoin News","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/cryptonews.uk.com\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/cryptonews.uk.com\/#\/schema\/person\/822778c5844e0d16d43dce6630f4f1bf","name":"\u884c\u653f","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/cryptonews.uk.com\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/e4c2d23409b09e004cef3facbe677e95c5401f9e29680f3a311e0130c5748089?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/e4c2d23409b09e004cef3facbe677e95c5401f9e29680f3a311e0130c5748089?s=96&d=mm&r=g","caption":"\u884c\u653f"},"sameAs":["http:\/\/demo3.aiwalls.com\/coinbase"],"url":"https:\/\/cryptonews.uk.com\/?author=1"}]}},"_links":{"self":[{"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=\/wp\/v2\/posts\/13700","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=13700"}],"version-history":[{"count":0,"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=\/wp\/v2\/posts\/13700\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=\/wp\/v2\/media\/13701"}],"wp:attachment":[{"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=13700"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=13700"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=13700"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}