Executive Summary

Bitget confirmed unauthorized transfers from hot wallets at 18:31 UTC on 24 September 2026. The exchange stated that cold wallets were not affected and that its protection fund exceeded $464 million. Public reporting placed the loss at approximately $351.6 million.

SentinelTX expanded the investigation to 289 addresses and 41 evidence items across Ethereum, Arbitrum, Avalanche and BNB Chain. The pattern is consistent with a hot-wallet signing or key compromise: one consolidation EOA appeared across chains, stablecoins were rapidly swapped into ETH, funds crossed bridges, and Ethereum proceeds were split into fixed-size tranches.

The clearest recovery lead is 20,763,612.55 USDC routed from Avalanche and Arbitrum through a common receiver into a Circle-labeled address. No centralized-exchange deposit or mixer exposure was confirmed in the reviewed scope.

Incident Anchors

Core Wallet Matrix

What the Cross-Chain Flow Shows

The primary consolidation address was active on Ethereum as early as 7 February 2026, contradicting descriptions of it as newly created. TRDB labels on two upstream addresses are useful leads, but do not independently prove Bitget ownership.

Confirmed Chain-Level Movements

Arbitrum: Swap, Split and Partial Stablecoin Recovery

On Arbitrum, 19,668,851.77 USDT0 reached a dedicated swap wallet and was converted through UniswapX and 1inch intents into 7,111.344304 ETH. One branch converted 2,513 ETH into 6,561,140.178933 USDC; another 26,830.363654 USDC joined the same receiver before the route reached a Circle-labeled address.

Key Transactions

Ethereum: Anchored Inflow vs. Gross Hub Activity

A confirmed transaction moved 1,541.51 ETH from the Ethereum source to the hub. The hub later sent several much larger tranches. Those gross outflows cannot all be attributed to this incident because only the 1,541.51 ETH inbound is directly anchored to the investigated path.

Bridges, Routers and Recovery Leads

Interaction with a router or bridge does not mean that service controlled the attacker.

What Remains Unproven

No threat actor has been identified. No evidence confirms a CEX deposit or mixer. The direct link from the multi-chain consolidation address to 0x469Ac1406dE92f82C0563477240a3627057425DC was not independently confirmed; it remains a third-party Bubblemaps claim. Zero-value and tiny lookalike transfers were excluded as address-poisoning noise.

Untraced Remainder

Conclusion

The evidence confirms coordinated cross-chain dispersal and a high-priority Circle recovery route, while leaving substantial balances and several bridge destinations unresolved. The urgent action is preservation and freeze outreach for the Circle-labeled path, followed by destination tracing for Across and deBridge.

Evidence note: wallet balances and labels reflect the SentinelTX investigation cutoff. Public statements, third-party labels and analytical inference are separated from transaction-confirmed facts.