Bitget lost $351.6M from hot wallets: what it means for arbitrage

Bitget lost $351.6M from hot wallets: what it means for arbitrage

On 24 September at 18:31 UTC Bitget systems logged unauthorised transfers out of the exchange's hot wallets, and the money went to a freshly created address. Around 183 million left in the first hour. The final figure came out higher: 351.6 million.

The exchange suspended withdrawals. For anyone holding working balances there for their pairs, the week ended that very minute. From what we see, it is events like this rather than price moves that most often wipe out an arbitrageur's monthly result.

What actually happened

Management ruled out a private key compromise straight away. According to CEO Gracy Chen, the attackers forged transfer records through a breached backend system, which means they came in not through cryptography but through ordinary corporate infrastructure.

Cold wallets were untouched. The money sitting offline stayed where it was, and only the layer the exchange keeps connected for daily operations took the hit. The split between hot and cold storage worked exactly as designed here.

The speed of the drain is impressive and frightening at once. One of the new addresses took USDT0 worth 19.67 million dollars and swapped it for 7,111 ETH in six minutes. Responsibility is attributed to a group linked to North Korea.

Why this hits arbitrage hardest

A trader with an open position waits out the pause and carries on. For someone who works on price differences the structure breaks differently: one leg of the pair is locked on a venue where withdrawals have stopped, while the other lives its own life on another exchange.

Then the unpleasant part starts. The price on the frozen venue detaches from the market, because you cannot take money out and there is nobody to sell to. On screen it looks like a gigantic spread. There is no way to collect it.

The third layer of the problem is margin. If the short sat on the affected exchange and the long next door, the price move eats collateral in a place you cannot top up.

The good news about the fund

Bitget said the whole amount is covered by its user protection fund, which holds more than 464 million dollars. So the venue's reserve exceeds the loss by roughly a third.

We reckon it is the presence of such a fund that separates a major venue from one where in a similar situation the money never comes back at all. The size of the reserve is worth checking before you move working capital there, not after the hack headline.

What to do right now

First, recount how much you hold on each venue. Not as a share of the portfolio but in absolute money you are ready not to see for a month.

Second, split your pairs so that both legs do not depend on one exchange. A setup where the buy and the sell go through different venues survives the freeze of one of them noticeably more easily.

Third, keep part of your capital off exchanges. A balance in your own wallet earns nothing, but it stays yours on any day of the week.

Fourth concerns reaction speed. In our experience the first hours after news like this produce the wildest gaps on the chart, and those are exactly the hours when mistaking an unreachable price for a workable opportunity costs the most.

Our tools

When one of the venues drops out, what matters is seeing not only the price but the state of the route. Our arbitrage screener keeps dozens of venues in one window, refreshes quotes every second and shows each gap together with the volume actually behind it. The spread calculator helps you check what survives fees, network costs and slippage at your size. The bot is fully manual. It never connects to your exchange API keys.

To test the tools on a live market, ArbitrageScanner offers one day of free access to the whole ecosystem.

FAQ (Frequently Asked Questions)

1. How much was stolen and from where?

351.6 million dollars from the exchange's hot and warm wallets. Cold storage was not touched, the funds there stayed safe.

2. Were the keys stolen?

No. The exchange states that a private key compromise is ruled out and that the attackers forged transfer records through a breached backend system.

3. Will users get their money back?

According to the venue the amount is fully covered by the user protection fund, which holds more than 464 million dollars. The reserve exceeds the loss by roughly a third.

4. Why is it worse for an arbitrageur than for a trader?

Because a pair consists of two legs on different venues. Freezing one leaves the other without its partner, while the price on the closed exchange detaches from the market and turns into an unreachable figure on screen.

5. How do you cut this risk in advance?

Split the legs of your pairs between venues, cap the amount on each exchange at a size you would not mind freezing for a month, and keep part of your capital in your own wallet.

Conclusion

The Bitget story turned out to be instructive not because of the size of the sum but because of where exactly the blow landed. It was not cryptography that broke but an ordinary internal system, and that was enough to move a hundred and eighty-odd million out in an hour.

For those who live on gaps the conclusion is simple and unpleasant. Venue risk is not visible in the order book and does not get counted in percentage returns, yet it wipes everything out at once, in a single evening. In our view the limit is simple. Keep on an exchange as much as you are ready not to see for a month.

IMPORTANT! We are software developers. We do not give recommendations or promises of earnings and we do not advise you to invest your money anywhere. Our software is fully manual, all your money stays under your own control. We show examples of how our clients have earned on arbitrage in the past, but we do not advise repeating those actions one to one. Your earnings depend solely on your own actions and on market factors.