Bitget Attacker Converts Stolen Assets Into 67,982 ETH Worth $183 Million

Key Facts

An attacker targeting wallets linked to Bitget converted assets into 67,982 ETH valued at about $183 million, according to Lookonchain. Bitget estimated funds affected by unauthorized transfers on September 24 at about $351.6 million. The figures describe different parts of the incident: the company's estimate of its scope and the reported value of one converted holding. The swap leaves a substantial ETH position under the attacker's control, but does not show that those coins were subsequently sold. For traders, the immediate question is where that holding moves next and whether it reaches a venue where it could be liquidated.

The reported $183 million ETH valuation is about 52% of Bitget's $351.6 million estimate of affected funds. That ratio compares a tracked ETH holding with the company's broader incident estimate; it is not a full accounting of every asset moved from its wallets. The 67,982 ETH figure is a quantity of coins, whereas its dollar value changes as ETH trades after the observation. The dollar figure is therefore a valuation at the time of the report, rather than a fixed amount attached to those coins. Separating quantity from valuation also prevents a later change in dollar value from being mistaken for another transfer.

Lookonchain said the attacker swapped most of the stolen assets it tracked on EVM-compatible chains into ETH. Those networks support transfers and exchanges of different tokens, allowing value held in several assets to be converted into a single one. This changes the composition of the tracked holding: its dollar value becomes more directly exposed to movements in ETH rather than the prices of several tokens. That matters even if the number of ETH coins stays constant, because the market value of the position can still change. The swaps alone do not establish the funds' final destination or the attacker's intended use of them.

Swapping assets for 67,982 ETH is not the same transaction as selling that ETH into the market. Potential sell-side pressure would arise if whoever controls the coins tried to liquidate them, with the impact depending on order size and available liquidity at the time. Coins could move between other wallets without an executed sale, while a change of custody might leave no immediate mark on the market price. The $183 million valuation by itself therefore cannot measure a prospective price move. Traders need to distinguish conversion into ETH, a later transfer of ETH and an actual sale, because each step carries a different implication.

Bitget said its systems detected unauthorized transfers from some hot wallets at 18:31 UTC on September 24. The company said the breach was confined to portions of its hot and warm wallet layers and that its cold wallets remained secure. That distinction means the $351.6 million estimate concerns funds affected by the incident, not all assets held by the exchange. It also explains why the investigation centers on wallets used for current operations while the company treats cold storage separately. The scope of the affected wallets does not, on its own, establish how the attacker obtained the ability to make the transfers.

Bitget said its User Protection Fund held more than $464 million and that it could cover the entire estimated $351.6 million loss. Comparing those figures explains the company's assurance about customer balances, but does not establish when claims would be settled or how much might be recovered. Stated loss coverage is also a separate question from reopening withdrawals or identifying the technical cause of the breach. The company said account balances were accurate and user assets protected while its investigation continued. The incident's eventual financial impact will depend on the final loss and how the protection arrangements are put into effect.

Bitget temporarily suspended withdrawals pending a security review, while saying deposits and trading remained available. Customers could therefore view balances and trade on the platform, but could not move assets out through withdrawals during the pause. That operating restriction is distinct from the question of loss coverage, even though the company says its protection fund is sufficient. For customers holding positions on the exchange, restoration of withdrawals will be a practical indication of progress in checking its systems. For ETH traders more broadly, the path of the converted coins matters more to assessing possible sales than the status of Bitget's withdrawal service.

Bitget said it identified, flagged and reported addresses associated with abnormal transfers and notified law enforcement and on-chain security firms. Identifying addresses may help investigators and recipients of funds recognize later movements, but it does not guarantee that assets will be frozen or recovered. A new on-chain transfer also cannot, by itself, establish whether a sale took place elsewhere. Tracking, preventing further movement and recovering funds are separate outcomes when assessing what the investigation might achieve. Bitget did not identify a technical cause in its notice and said it would wait for the investigation before describing the attack method.

Bitget pledged hourly updates and an incident report within 24 hours covering the root cause and corrective measures. It said withdrawals would resume after its security review, without giving a fixed reopening time in the notice. The report will be central to assessing whether the $351.6 million estimate holds and how the company addresses the weakness that allowed the transfers. Meanwhile, subsequent movements of the 67,982 ETH holding will matter more to assessing whether it might reach a trading market. Any judgment about effects on ETH or exchange customers remains conditional on those developments, rather than the size of the initial conversion alone.