On-chain monitors have flagged more than $170 million in cryptocurrency moving out of wallets associated with crypto exchange Bitget, in a suspected security breach that remains unconfirmed. Neither the reported attack method nor a final loss total had been established at publication.

The Block reported that it had contacted Bitget to ask whether the transfers were tied to a security incident and whether withdrawals had been paused, but no public explanation from the exchange had been identified at the time of writing.

The alerts concern wallets tied to Bitget's exchange infrastructure. They do not establish any compromise of the separately branded Bitget Wallet self-custody application. The distinction matters because assets held on a centralized exchange sit in wallets the platform controls, while a self-custody wallet keeps the private keys with the individual user.

What the on-chain trail reportedly shows

According to The Block, on-chain data appeared to show more than $170 million moving from Bitget hot and cold wallets to a single address over roughly an hour. Hot wallets stay connected to the internet so exchanges can process day-to-day withdrawals, while cold storage keeps reserves offline, which is why outflows reportedly touching both categories in the same window drew immediate scrutiny. The transfers reportedly included ETH, USDT, USDC, AVAX and BNB.

Wu Blockchain said, citing MLM monitoring, that three hot wallets and one cold wallet were suspected of being involved. The account linked the activity to 0x770b10b273fC44Fe9197D6bF20F145c2e98463Ee and stressed that both the attack vector and the total losses remain unconfirmed. The Block also shared the report on X.

Withdrawal complaints create a separate question

The Block additionally noted social-media posts and online reports from users who said they were experiencing withdrawal problems. Those claims do not establish that Bitget has suspended withdrawals, nor do they prove that any service issue is connected to the flagged wallet movements. Across the industry, exchanges commonly pause or limit withdrawals as a protective step while they investigate a suspected incident, so confirmation either way would carry information of its own.

They nevertheless raise a second question for the exchange. If the transfers were authorised wallet management, Bitget can identify the receiving address and explain whether users are facing an unrelated operational delay. If the two developments are connected, a public response becomes more urgent.

Why $170 million moving does not yet mean $170 million was stolen

Exchanges regularly shift large balances between hot wallets, cold storage and liquidity-related addresses. A large transfer can look alarming on a blockchain explorer while still being authorised wallet management.

The reported pattern here is more difficult to dismiss than a single transfer, because assets from several wallets reportedly reached one fresh address — rather than the long-established addresses exchanges typically use for internal sweeps — and then entered swaps. Even so, that is evidence worth investigating, not proof of theft.

The missing fact is simple: does Bitget control the receiving address? If the exchange identifies it as an internal operational wallet, the breach theory weakens sharply. If the funds continue through bridges (tools for moving assets between blockchains), mixers (services designed to obscure transaction trails) or wallets unrelated to Bitget, the case for an unauthorised outflow becomes much stronger.

Three answers matter more than the first loss estimate

Is the destination address controlled by Bitget?

This is the fastest way to separate internal wallet management from a possible compromise. The destination address is publicly visible; only Bitget can say whether it controls it.

Were the transfers authorised?

Bitget needs to clarify whether the wallets acted through normal signing procedures or whether access to any part of its infrastructure was compromised. Until then, claims about the method behind the transfers remain speculation.

Are users or platform services affected?

The on-chain reports do not establish that customer balances, deposits, withdrawals or trading services have been affected. A public update on those points would matter more to users than another revised estimate of the outflows.

What would settle the question

A formal Bitget statement is the next important development, but independent tracing will matter too — exchanges facing suspected breaches commonly engage specialist analytics firms for exactly that purpose. Security firms can follow whether the ETH remains in the recipient wallet, is moved through bridges, reaches exchange deposit addresses or enters recognised laundering routes.

That evidence will determine whether the story remains a suspicious sequence of wallet movements or becomes a confirmed exchange security incident. Until then, the $170 million figure should be treated as reported on-chain volume, not a final accounting of losses.

This article is provided for informational purposes only and does not constitute financial or investment advice. Wallet labels and on-chain estimates can change as new information emerges.