Bitget Suffers $228M Crypto Theft in 18 Minutes as Arkham Traces Funds Across Seven Chains

Bitget has suspended withdrawals after attackers moved approximately $228 million from the cryptocurrency exchange in an incident that unfolded in just 18 minutes, according to an analysis by blockchain intelligence firm Arkham. A broader review of the stolen assets placed the total value involved at about $350 million across seven blockchains, underscoring the scale and complexity of the breach.

The incident left customers unable to withdraw funds while Bitget and investigators worked to identify the affected wallets and trace the movement of the assets. Among the funds under scrutiny was approximately $153 million in XRP, making the token one of the largest identifiable components of the suspected theft.

The rapid pace of the transfers is central to the investigation. According to Arkham’s assessment, the attackers removed $228 million from Bitget within an 18-minute window. Such a concentrated sequence of transactions can complicate an exchange’s ability to isolate compromised wallets, halt outgoing transfers and determine whether the activity reflects a single coordinated operation or a series of linked movements.

Blockchain transactions are publicly visible, but visibility does not necessarily make stolen assets easy to recover. Investigators must follow the funds across wallets, networks and, in some cases, trading platforms or other services that may be used to exchange one digital asset for another. The seven-chain footprint identified in Arkham’s analysis adds another layer to that process because each network can have different transaction systems, token standards and monitoring requirements.

Bitget’s decision to pause withdrawals is intended to limit additional losses while the exchange reviews its systems and account activity. A suspension can affect customers who have no connection to the breach, but exchanges commonly use such measures during a security investigation to prevent further unauthorized transfers and preserve evidence. The source material did not indicate when withdrawals would resume or how many customer accounts were directly affected.

The difference between the $228 million that reportedly left the exchange during the 18-minute period and Arkham’s broader estimate of roughly $350 million appears to reflect different measurements of the incident. The first figure describes funds that moved out of Bitget during the rapid draining episode, while the larger figure concerns the estimated value of assets connected to the breach across seven blockchains. The exact composition of the wider total was not provided.

XRP’s reported $153 million share highlights the importance of token-specific tracing in the investigation. Digital assets can be distributed across numerous addresses, and their value can change as prices fluctuate. As a result, estimates of the amount stolen may vary depending on when the assets are valued, whether the calculation includes tokens later moved between wallets, and how investigators distinguish directly stolen funds from related transfers.

The breach also illustrates the operational risks facing large digital-asset exchanges. These platforms manage substantial holdings across hot wallets, custody systems and internal transfer mechanisms. A compromise of a wallet, signing process or administrative control can allow large sums to move quickly, even when the underlying transactions remain permanently recorded on a public ledger.

Arkham’s role is to map those movements and associate wallet activity with suspected entities or incidents. Its analysis can help identify the sequence of transfers, the networks involved and the current or historical locations of assets. That work does not by itself establish who carried out the attack, nor does it guarantee that the funds can be frozen or returned. Recovery generally depends on whether assets reach a regulated exchange, remain in identifiable wallets or are converted into forms that are more difficult to track.

For Bitget users, the immediate issue is access to their accounts and the status of their holdings. The exchange’s withdrawal pause means customers must wait for further information about the scope of the incident and the safeguards being put in place. No recovery timeline, reimbursement plan or final accounting was included in the available report.

The reported theft comes amid continuing scrutiny of security practices in the crypto industry, where irreversible transactions and globally connected markets can allow attackers to move funds across borders within minutes. Exchanges responding to such incidents typically examine wallet permissions, transaction approval procedures, employee access and monitoring systems. They may also coordinate with blockchain analysts, other trading platforms and law-enforcement agencies as they attempt to track the assets.

Until that review is complete, the figures remain estimates rather than a final loss statement. Arkham’s analysis provides an early picture of the activity, including the 18-minute period and the seven blockchain networks, but further investigation could change the valuation or clarify which assets were taken directly from Bitget. For now, the exchange remains focused on containing the incident while investigators follow the digital trail, including the substantial XRP transfers.