Bitget theft incident tracking

Zhao Changpeng posted that today is a difficult day for Bitget. He believes and knows that Binance, the BNB Chain ecosystem, and the community will do everything possible to provide assistance, and he calls on the community to stay "SAFU".

Bitget stated that the withdrawal recovery plan will be announced before September 26 at 4:00 UTC (12:00 Beijing time) and thanked users for their patience.Bitget previously confirmed that approximately $387.5 million in assets were transferred to addresses controlled by attackers during this security incident, involving assets such as ETH, XRP, USDT, ZEC, USDC, USDT0, XAUt, BNB, AVAX, and TRX.Bitget claimed that the incident is currently under control, and no further unauthorized transfers have been detected. Withdrawals are temporarily suspended, and investigations and asset tracking are still ongoing.

According to on-chain data, Tether has successfully frozen 218,000 USDT in the stolen address from Bitget, which is a "three-hop" associated address of the initial stolen address from Bitget. This address remained inactive for over 2.5 hours after being discovered.Crypto KOL tanuki42 initiated a tracking of "Circle vs Tether" at that time and asked which of the two companies would freeze the related assets first.Currently, Circle has frozen the related stolen assets 7 hours and 18 minutes earlier than Tether.

According to on-chain analyst tanuki42, the address 0xe07 holds 100,000 USDC and 218,000 USDT, which come from the initial address of stolen funds from Bitget. This batch of funds has been idle for over 2.5 hours, after which they publicly called on Circle and Tether to freeze the assets.At 5 PM, crypto researcher SomaXBT posted that Circle has frozen the USDC assets and specifically called on Tether to follow up. As of the time of publication, Tether has not responded.

ViaBTC founder and CEO Yang Haibo stated: CoinEx is shutting down, but its hot wallet system is still relatively advanced and worth referencing in the industry. He introduced that CoinEx has implemented an MPC-based dual-signature scheme for its hot wallet to eliminate single points of failure.Yang Haibo mentioned that the relevant infrastructure is split into business systems and wallet systems, operated by completely independent teams, each holding one private key. Every withdrawal or transfer must be reviewed in real-time through substantial risk control by both parties, and even if one system is compromised, assets cannot be stolen.He added that the wallet signing process needs to be independently implemented and cannot rely on the native mechanisms of each node, which requires extensive reconstruction. The team spent over a year transforming the vast majority of nearly 300 chains supported by CoinEx one by one.

Binance Co-CEO Richard Teng stated that since the discovery of the security incident at Bitget, the Binance security team has been closely collaborating with Bitget to assist in sharing security intelligence, tracking related funds, and supporting asset recovery efforts.Richard Teng mentioned that in such security incidents, the cryptocurrency industry will unite to respond to attackers, and the relevant assistance work is still ongoing.

Bitget CEO Gracy Chen stated that Bitget is conducting a comprehensive investigation into the recent platform security incident in collaboration with independent third-party expert Mandiant and Slow Mist. The platform will continue to release the latest updates through official channels.He emphasized that ensuring user safety is Bitget's top priority at the moment, and user balances remain intact. The Bitget User Protection Fund will cover the impacts caused by this platform-level incident. The Bitget Wallet is a self-custody wallet, using infrastructure that is completely separate and independent from Bitget Exchange, and therefore was not affected by this incident.Currently, the recharge, trading, and reward functions of Bitget Exchange are still operating normally. The withdrawal function remains suspended during additional security checks and will be reopened as soon as the platform confirms it can be safely restored.

Bybit co-founder and CEO Ben Zhou stated that the Bybit team is ready to assist in various ways regarding the recent hacking incident involving Bitget. Previously, when Bybit faced a hacking attack, Bitget provided support.Ben Zhou mentioned that Bybit is currently updating the LazarusBounty platform to assist Bitget in tracking the relevant flow of funds.On February 21, 2025, Bybit experienced the largest hacking attack in cryptocurrency history at that time (approximately $1.46 billion to $1.5 billion worth of Ethereum was stolen, later attributed to the North Korean Lazarus group). After the attack, Bitget quickly transferred 40,000 ETH (approximately $10.5 million to $10.6 million at that time) to Bybit, with the funds coming from Bitget's own reserves, not user assets. This support was an interest-free, unsecured loan with no fixed repayment deadline, aimed at helping Bybit cope with withdrawal runs and replenish liquidity.

Bitget Wallet posted on platform X stating that it operates independently from Bitget Exchange, belonging to a self-custody wallet, where user assets are always on-chain and controlled by the users themselves, isolated from the custodial infrastructure of Bitget Exchange.In response to the recent security incident at Bitget, Bitget Wallet has conducted preventive checks on its internal systems and found no security impact on the Bitget Wallet system or user self-custody assets. Currently, Bitget Wallet is operating normally and reminds users to be vigilant against phishing and impersonation activities, and to obtain the latest information through official channels.

X Platform post by Xu Jiayin stated that Bitget has commissioned a third-party security team to conduct an independent forensic investigation into this security incident. Multiple teams are working together to verify remedial measures, confirm the attack vector, and assist in law enforcement cooperation. The investigation results will be announced promptly.He stated that Bitget has sufficient protection funds to cover the related losses and will restore withdrawals as soon as all potential security risks are eliminated.