Bitget hack, four days later: $388M confirmed, 60 million XRP deposited into four Binance accounts, 19,000 ETH through THORChain

When we stopped live coverage at 12:45 UTC on September 25, one XRP parking wallet was leaking into a laundering pipeline, the other four were full, and the eight Ethereum parking wallets had not moved. This is what happened in the four days since, from Bitget’s own disclosures and from the ledgers. Prices used: XRP $1.49, ETH $2,680, BTC $83,431. All times UTC.

What Bitget has confirmed

The loss is $387.5 million, not $351.6 million. The revision came from classifying additional Zcash and TRON transactions. Bitget now counts 11 chains (Ethereum, XRP Ledger, Zcash, TRON, Arbitrum, Optimism, Base, BNB Smart Chain, Avalanche, Algorand, Celestia) and 12 wallet addresses, with XRP, ETH, USDT, ZEC, ATOM, USDC, USDT0, XAUt, BNB, AVAX, TRX, ALGO and TIA among the affected assets. No per-asset breakdown has been published.

The entry point was a third-party security product. Bitget’s account, repeated by CEO Gracy Chen in interviews with The Block and The Hacker News: the attacker exploited a zero-day vulnerability in a security product Bitget runs, obtained high-level internal credentials, used them to reach an internal management system, and from there inserted fraudulent withdrawal commands into the wallet backend, which the signing pipeline treated as legitimate. The activity was disguised as routine administrative work and traces were deleted. Private keys were not compromised. The vendor has not been named; Bitget says it notified the vendor, disabled the affected functionality and revoked and reissued internal credentials. Mandiant and SlowMist are running the forensic investigation and a formal report is expected this week.

The attacker rehearsed. Chen told The Block that two small test transfers were made at 18:31 UTC, one in ETH and one in TRX, both below risk thresholds, about 27 minutes before the main theft. We documented the ETH one in part 1: 0.84 ETH from hot wallet 0x1AB4…8F23 at 18:31:11. Hypernative’s analysis adds that the main drain came in two waves, 15 seconds of signing at 19:01 that moved $87.6 million from hot wallets across five networks, and nine seconds at 19:16 that moved $202.8 million from warm wallets, and that the attacker’s transactions used round gas limits (100,000, 200,000, 50,000,000) where Bitget’s normal pipeline used calculated ones.

Bitget’s own timeline confirms the containment gap. The official chronology reads: 18:31 unauthorized transfers begin; 19:05 risk-control system auto-blocks withdrawals; 19:14 highest emergency response; 19:40 containment begins; 20:40 fund transfers to cold storage begin; 21:44 withdrawal and signing services shut down. Set that against the ledger. The attacker’s last transfer from a Bitget wallet was 223 ETH at 21:23:11, and the last XRP transfer was 9.3 million XRP at 21:19:21. The 19:05 block stopped customers, not the attacker. And the 20:40 entry deserves attention: at 20:40:02 Bitget’s XRPL aggregation wallet moved 2,183,079 XRP into the hot wallet the attacker was draining, and at 21:19 the attacker took 9,306,866 XRP from it, a transfer that had failed 51 minutes earlier for lack of funds. Whether that top-up was part of the cold-storage consolidation or an automated rebalance, it ran through a wallet that was still under the attacker’s control.

Withdrawals are back, in phases. BTC on September 28 at 08:00 (Bitget says more than 3,000 BTC were processed in the first hour), ETH on September 29 across Ethereum, BNB Smart Chain, Arbitrum, Base and Optimism, USDT on September 30, and all other tokens, fiat and P2P on October 2. The protection fund, about $465 million, absorbs the loss and Bitget says it will be replenished to at least $300 million within a week from corporate reserves. A 5 percent bounty is offered on frozen or recovered funds, and Bybit’s LazarusBounty platform is being used as a recovery channel. Chen also asked THORChain to refuse service to the attacker’s addresses; THORChain replied that its network halt is an emergency mechanism, not a selective freeze.

The XRP: all of it moved

In part 2 the 102.9 million XRP sat in five parking wallets. Between 12:25 UTC on September 25 and 07:43 UTC on September 27 every one of them was emptied, in 80 to 108 payments each, into roughly 25 freshly created distribution accounts. One parking wallet, r3UGfDM4ZyFSCzKH7TQEjgago9QoUJagtJ, was then deleted from the ledger at 14:14 on September 26, which reclaims the reserve and removes the account from balance-based watchlists.

Parking wallet	XRP out	Window
rDRV9…95hs	20,006,821	Sept 25 12:25 to Sept 26 00:24
r3UGf…agtJ	20,474,975	Sept 26 01:35 to 08:40, then deleted
rH7oM…CqZn	20,129,625	Sept 26 08:05 to 15:49
rwSjB…sAKw	20,033,307	Sept 26 15:11 to 23:00
r6Ncw…Cs7Y	23,066,314	Sept 26 22:50 to Sept 27 07:43

The distribution accounts did not scatter the money. They funnelled it back into the same five-account hub network we described in part 3: the hub r4du…T5ig, the collector r3n8sb…HpN1 and the feeders rU7dx6…UnDF, rpnu6d…anqi and rGP5LB…6Esp. Account after account shows the same five destinations. rsiNZr8…ePNz, for instance, received 9.8 million XRP and paid 9.84 million out in 761 payments, every one of them to those five accounts. rwSFhq…ik1WD made 1,253 payments, again all to the same five. This was one operation with one exit.

And the exit is Binance. The four exit accounts that drain the hub kept doing exactly what they did on September 25, only at scale. Counting only payments that carry a destination tag, which on the XRP Ledger identifies a customer account at an exchange:

Exit account	Deposits	XRP	Binance customer tag	Last deposit
rhbgGt…mBLa	1,422	28,431,837	469304937	Sept 28 03:51
rNnMCi…RzfS	2,589	25,675,366	470475839	Sept 27 07:32
rs6Sp4…Q1gr	510	2,985,282	465674229	Sept 26 03:12
rfF1rd…BYaL	452	2,815,378	472578608	Sept 28 20:26
Total since Sept 25 12:37	4,973	59,907,863 XRP (about $89M)	all to rNxp4h8apvRis6mJf9Sh8C6iRxfrDWN7AV, labeled Binance 11 on XRPScan

Add the 488,000 XRP deposited before our cut-off and about 60.4 million XRP, 58 percent of the stolen XRP, went into four Binance customer accounts in a little over three days, in chunks of two to eleven thousand. The MEXC account used briefly on September 25 received nothing further. The hub network still holds about 780,000 XRP, and several distribution accounts had not finished paying out when we checked, so the figure will rise.

Two things we cannot say from the ledger: whether Binance has frozen those four accounts, and what happened inside Binance to the XRP that arrived. Deposits continued to be accepted through the evening of September 28. We found no evidence of XRP going to THORChain or to any other labeled exchange; the FixedFloat probes from September 25 stayed at test size.

The ETH: half moved, half still parked

The eight Ethereum parking wallets held 68,295 ETH on September 25. Five of them have since moved:

Wallet	Was	Now	What happened
0xD2C2…F899	10,000	0	dispersed to ten addresses on Sept 27, 18:45 to 20:06
0x52f0…d284	3,698	0	4,326 ETH to 0x600c…84b2 on Sept 28 11:52
0xDc29…dC63	4,596	0	4,596 ETH to 0x600c…84b2 on Sept 28 14:28
0x9FA3…4FA0	10,000	0	10,000 ETH to 0x600c…84b2 on Sept 28 18:55
0x600c…84b2	10,000	4,844	consolidated the above, then dispersed about 24,000 ETH to twelve addresses on Sept 28, 18:57 to 20:57
0xA6BF…B272, 0xFd5E…9e54, 0xeD5a…1A51	10,000 each	10,000 each	untouched

So 33,451 ETH has moved and 34,844 ETH (about $93 million) is still parked.

The moved ETH went through a two-level peel. The twelve first-level addresses each received 100 to 1,000 ETH and either sent it straight into THORChain’s router or passed it to a second level that did. Counting depositWithExpiry calls to the THORChain Router contract:

Address	ETH into THORChain	Swaps
0x132E…afDD	2,242	30
0x4fEB…88AB	2,175	214
0x3287…A0f7	2,099	241
0x0DAc…C128	2,067	233
0x0DB1…A47e	1,909	218
0x41c8…902C	1,634	248
0xAabC…e451	1,543	24
0x2971…6932	1,452	30
0x5119…4E6C	1,413	24
six others	2,641	79
Total	19,174 ETH (about $51M)	about 1,340

Arkham and Cointelegraph report the THORChain output as bitcoin, which matches the Bybit playbook. A further 6,373 ETH went into a contract Blockscout labels LZMultiCall, a LayerZero-based multicall we could not attribute to a named product, 845 ETH into CoW Swap, and several thousand ETH sits in second-level addresses (0xbC7C…757e holds 1,951) that have not yet reached a swap. The counts above stop at two levels, so the THORChain figure is a floor.

Where the $387.5 million stands

	Moved out of parking	Still parked or staged	Notes
XRP	102.9M, of which 60.4M is inside four Binance accounts	about 0.8M in the hub network, the rest in distribution accounts still paying out	one parking account deleted
ETH	33,451 ETH; at least 19,174 swapped via THORChain, 6,373 via LZMultiCall, 845 via CoW Swap	34,844 ETH in four wallets	THORChain output reported as BTC
TRX, BNB, ZEC, others	not traced by us	SlowMist reported 20.6M TRX and 5,897 BNB held on Sept 25	Zcash leg about $29M per Hypernative

What to take from it

The Binance accounts are the story. Five thousand deposits into four customer accounts over three days, from four exit addresses that were themselves created by Binance withdrawals in 2025, is not a pattern that hides from an exchange’s own monitoring. Whether Binance froze those accounts, when, and how much XRP was withdrawn before it did, is the single most important unanswered question in this case. Binance has not commented. Bitget’s statement that “some assets” were frozen through partner coordination may refer to this; it has given no numbers.

The root cause is still a description, not a report. “A zero-day in a third-party security product” covers a lot of ground: an endpoint agent, a privileged-access manager, a secrets vault, an HSM front-end. Which one, and how a credential from it reached the wallet backend’s command path, is what the promised Mandiant and SlowMist report has to answer. Until then the practical lesson is the one Hypernative drew: the signer trusted an internal service to tell it the destination and amount, and nothing independent checked the request against a customer withdrawal or a treasury allowlist.

The containment gap is now official. Bitget’s own timeline puts signing shutdown at 21:44, three hours and thirteen minutes after detection. Everything the attacker took after 19:05, including the 9.3 million XRP that a Bitget top-up made possible, was taken while the exchange knew it was under attack.

We will publish again when the incident report lands, when the remaining 34,844 ETH moves, or when Binance says what happened to the four accounts.