Bitget Hack Drains $351.6M, Fake Account Targets Users

High attention and emotional sentiment detected.

Two separate things happened that night, and mixing them up is exactly how the scam worked. One was a real breach of Bitget’s custodial exchange wallets. The other was a lookalike X account posing as Bitget Wallet.

Bitget CEO Gracy Chen said the exchange’s security systems detected unauthorized transfers at 18:31 UTC on 24 September. According to her official notice, the affected total came to about $351.6 million.

What the Bitget hack actually hit

The breach struck Bitget Exchange, the custodial platform, not the self-custodial Bitget Wallet app. That distinction matters, because the two share a brand but hold funds very differently.

Chen said only a portion of the hot and warm wallet layers were touched. She added that cold wallets remain fully secure. So the damage, while large, stayed inside the exchange’s online custody tiers.

The drained assets spanned several chains. They included ETH, XRP, USDT, USDC, AVAX, BNB, and USDT0. The flows crossed Ethereum, the XRP Ledger, Avalanche, BNB Chain, and Arbitrum.

Bitget also said the loss falls within its User Protection Fund, which it claims holds more than $464 million. In other words, the roughly $351.6 million hole sits at about 76% of that declared fund. Still, withdrawals were paused while deposits and trading stayed open.

A fake account turned the Bitget hack into a phishing lure

About twelve minutes after Chen’s notice, an account called @BitgetWalletApp posted an emergency message. It told users to temporarily revoke approvals for its contracts and ended with a “Learn more” link.

That account is not the official Bitget Wallet handle. The real one is @BitgetWallet, which carries roughly 2.88 million followers. The impersonator had about 6,000 followers, yet its post still reached around 202,000 views.

The scammer copied the wallet’s Instagram handle, its emoji, and its “100M users” bio. As a result, the post looked convincing. Some aggregators even repeated the revoke line as if it were official guidance.

Then the real account stepped in. At 02:06 UTC on 25 September, Bitget Wallet posted a blunt correction: “BITGET WALLET IS NOT AFFECTED.” It also urged users to watch for phishing and impersonation.

How the attackers moved the money

On-chain watchers spotted the outflows before any official word. Blockchain security firm PeckShield first flagged a potential hot-wallet hack above $178 million.

Analytics platform Bubblemaps then tracked about $180 million flowing across multiple chains to a single address. Etherscan tagged that wallet as “Bitget Exploiter 1.” The consolidation address sits at 0x770b10b273fC44Fe9197D6bF20F145c2e98463Ee.

Early on-chain estimates ranged from roughly $145 million to $192 million, well below the official figure. The gap narrowed once Lookonchain published a fuller token breakdown that added about 102.93 million XRP, worth around $157 million.

According to Lookonchain, the attacker then swapped most of the EVM loot into roughly 67,982 ETH. That flow pushed value into ETH, but it was not an attack on any Ethereum protocol.

What Bitget says caused the breach

Chen offered a working explanation in a follow-up post at 00:43 UTC on 25 September. She said attackers compromised a critical backend system inside the wallet infrastructure.

From there, she said, they spoofed transaction data and triggered Bitget’s own authorization process to move funds out. In short, the story points to privileged internal-system abuse rather than a leaked private key.

Chen also said private-key compromise has been ruled out, and that no further unauthorized transfers are possible. The exact intrusion path, however, is still under investigation.

Why “revoke approvals” was the wrong advice

An approval is a permission slip. When you use a decentralized exchange or bridge, you sign a transaction. That signature lets a contract pull a set amount of your tokens.

Revoking that permission helps if a specific contract you already approved was compromised. Yet it does nothing when an exchange hot wallet is emptied from the inside, which is what Bitget describes here.

For that reason, a mass “revoke our contracts” blast from an unknown account is a classic drainer tactic. Clicking a panic link can prompt you to sign a fresh malicious approval instead. Bitget Wallet says users should only follow updates from its official channels. This article is not financial advice.

What remains unknown after the Bitget hack

Several questions are still open. Bitget has not detailed exactly how the backend was breached, whether through malware, a vendor, or leaked admin credentials.

There is also no official count of drained customer accounts. So far there is no confirmed timeline for reopening withdrawals either. Claims of state-linked hacking groups remain speculation that Bitget has not confirmed.

Meanwhile, the market reacted fast. Bitget’s BGB token slid roughly 6% as the reports spread, trading near $1.96. That drop shows how quickly confidence can wobble even when spot books stay open.

Bloomberg, The Block, and CoinDesk have all confirmed the $351.6 million figure and the withdrawal halt. Bitget has promised a full incident report. The clearest test now is whether its protection fund actually covers users.