Major exchange hack converts $183M into ETH

TLDR

Crypto exchange Bitget was hacked and the attacker has concentrated about $183 million of stolen assets into Ethereum (ETH).

1. Bitget lost roughly $351.6 million across multiple chains, with about $183 million converted into around 68,000 ETH in attacker-controlled wallets.
2. Bitget says user balances and cold wallets are safe, withdrawals are paused, and its $464 million User Protection Fund will cover the loss.
3. The large ETH position and suspected state-linked attackers increase tracking, sanctions, and future selling-pressure risks that crypto users should monitor.

Confidence: high because multiple independent news and on-chain sources confirm the loss size and ETH conversion.

Deep Dive

1. What Was Stolen And How It Became ETH

Reports show unauthorized transfers from Bitget-linked wallets on September 24 involving assets like ETH, XRP, USDT, USDC, AVAX, BNB, TRX and gold-backed XAUt across several networks, including Ethereum, Arbitrum, Avalanche, BNB Smart Chain and XRP Ledger. Analysts initially traced about $183 million leaving Bitget wallets for a single address in under an hour, with a fresh wallet spending $19.67 million in USDT0 to buy 7,111 ETH via UniswapX and 1inch Fusion, paying up to 5% above market price for speed. On-chain follow-up indicates most EVM-chain loot was ultimately converted into roughly 67,982 to 68,500 ETH, worth about $183184 million, representing about half of the total stolen amount and concentrating the attacks value in Ethereum.

2. Bitgets Response And User Protection

Bitgets CEO Gracy Chen confirmed a breach of its hot and warm wallet infrastructure totaling about $351.6 million while stressing that cold wallets and user balances are intact, backed by a User Protection Fund holding over $464 million. The exchange says the attacker compromised a backend wallet system, spoofed transaction data, and triggered its signing process, while private key compromise has been ruled out, and withdrawals are suspended during a security review even as trading and deposits continue. Chen has indicated preliminary evidence pointing toward North Korean-linked groups such as Lazarus, based on IP and attack-pattern similarities, but attribution remains officially unconfirmed while investigations continue.

3. Market, Policy, And Risk Implications

The rushed conversion of stablecoins and other assets into ETH at a premium shows the attacker prioritized speed and censorship resistance over price, underlining why major hacks often funnel into large, liquid assets like ETH. A single cluster holding roughly $183 million in ETH is systemically relevant for surveillance and sanctions risk, as analytics firms and law enforcement will likely track these addresses closely, and any move into mixers or bridges could trigger new compliance responses across venues. For users and institutions, the event reinforces hot-wallet risk on centralized exchanges and the value of segregated, regulated custody, as well as the need to monitor Bitgets withdrawal status and any future selling flows from the exploit-linked ETH wallets.

Conclusion

The Bitget hack shows how a single backend failure can rapidly turn a multi-chain asset mix into a concentrated ETH trove worth about $183 million, creating both traceability and future market-risk concerns. Bitgets commitment to cover losses via its protection fund reduces direct user impact, but until withdrawals resume and the full technical report is out, the episode underscores persistent centralized-custody risk and the importance of tracking exploit-linked ETH flows as a potential source of pressure and policy action in the wider crypto market.