left the exchange in under three hours
Public reportingBitget: Exchange Wallet Drain
Twenty-seven minutes between the test transaction and the first large transfer. The film reads each one from its receipt, including a stranger's contract that wrote a thousand token events into one transaction.
- Date
- September 24, 2026
- Network
- Ethereum
- Reported amount
- $387.5Mleft Bitget in under three hours
- What happened
- Exchange wallet drained after a small test
- Status
- Attribution disputed (reported)
- This file rests on
- 9 recorded and 8 reported statementsacross 5 linked identifiers
8 chapters · choose one to jump the film to it
Replay it yourself.
These are the film’s own beats. Choose a time to jump the film there. Where a step rests on a record, open it in the workspace and read today’s capture of the same record.
The theft
$387 million leaves the exchange Bitget in under three hours. This case asks what one wallet can tell you about it.
Reported by others- $387.5M left Bitget in under three hours.Public reporting
The test
The wallet's very first transaction is a test: 0.84 ETH. Small enough that no alarm went off.
Recorded · captured October 5, 2026- 0x1AB497…8f8F23 sent 0.84 ETH to 0x770b10…8463Ee.
Reported by othersOpens a live lookup on the Summary view. Today’s capture may differ from the film’s.- The transfer was at 18:31 UTC and came from Bitget's hot wallet.Public reporting
- No alert was raised on the test transfer.Public reporting
The first large transfer
Twenty-seven minutes later the same wallet receives about 34.7 million dollars of Tether in a single transfer. More follows: USDC, tokenised gold, thousands of ETH.
Recorded · captured October 5, 2026- One token transfer of 34,751,168.12 USDT to 0x770b10…8463Ee.
Reported by othersOpens a live lookup on the Activity view. Today’s capture may differ from the film’s.- In the same hour the wallet received 12,852,046.24 USDC, 3,000.32 XAUT, and 7,130.86 and 13,965.93 ETH.Blockscout (public explorer)
It starts to leave
Then it leaves, ten thousand ETH at a time.
Recorded · captured October 5, 2026Opens a live lookup on the Summary view. Today’s capture may differ from the film’s.- 0x770b10…8463Ee sent 10,000 ETH to 0xD2C2f0…d9F899.
The wallet today
Almost nothing is left. Its history is already older than the tool reaches back, and the tool says so. The same address has state on five networks.
Recorded · captured October 5, 2026Opens a live lookup on the Summary view. Today’s capture may differ from the film’s.- A balance of 0.008865 ETH.
- No activity retrieved: it is older than the lookup's window.
- State found on Ethereum, Base, Arbitrum One, Optimism and Avalanche C-Chain.
The strange part
Hours later an explorer shows this wallet sending ten thousand ETH again. It never did. A stranger's contract wrote a thousand token events into one transaction, bait in the form of a look-alike address.
Recorded · captured October 5, 2026- 0x1584a8…A3c7DD called 0x77EB52…295314.
- The receipt holds 1,000 logs.
- Events alone do not establish a swap or an actual balance change.
Reported by othersOpens a live lookup on the Activity view. Today’s capture may differ from the film’s.- A fake "ETH" token row and two look-alike addresses appear on the explorer.Blockscout (public explorer)
Where the tool stops
From here the money crosses to other blockchains and into mixers. That is the boundary of what this lookup observes.
Reported by others- Funds went to four destination chains, about $269M of it through THORChain.Public reporting
Who did it
Two published positions disagree, and the film reports both without endorsing either.
Reported by others- The theft is attributed to North Korea.Chainalysis
- The on-chain overlaps point to shared launderers, not necessarily the same attackers.BlockSec
What the headline said. What a closer reading shows.
in the one transfer this case reads from its receipt
Recorded in the transactionThe incident on one map
Who called what, and where it went.
Recorded in the workspaceReported by others
In the order it happened.
A 0.84 ETH test transfer reaches the wallet.Recorded
34.75M USDT arrives in one transfer, 27 minutes later.Recorded
USDC, tokenised gold and thousands of ETH follow.Reported by others
A stranger's contract writes 1,000 token events into one transaction.Recorded
The wallet holds 0.008865 ETH.Recorded
The cast
Open the investigation ↗Every address and transaction in this case.
Grouped by their place in the records. A group says what an address did here, not who controls it. Supported identifiers open as live lookups.
Where it went
Addresses that received the value. Who controls them is not established here.
- The attacker-side walletEthereum address
Received the test transfer and the large transfers. The film asks what is left in it.
The transactions
The individual records each step of the case rests on.
- The test transferEthereum transaction
0.84 ETH, twenty-seven minutes before the first large transfer.
- The first large transferEthereum transaction
One outgoing token transfer of about 34.75M USDT.
- A native outflowEthereum transaction
10,000 ETH sent onward from the wallet.
- The event floodEthereum transaction
A stranger's contract writing a thousand token events into one transaction.
Two kinds of statement, kept apart.
Recorded statements were read in the workspace on October 5, 2026. Reported statements come from the source named beside each one and were not verified by Forensia. The trail stops at the cross-chain boundary. What happened beyond it is reported, not observed.
What the chain records9
- Step 2
0x1AB497…8f8F23 sent 0.84 ETH to 0x770b10…8463Ee.
- Step 3
One token transfer of 34,751,168.12 USDT to 0x770b10…8463Ee.
- Step 4
0x770b10…8463Ee sent 10,000 ETH to 0xD2C2f0…d9F899.
- Step 5
A balance of 0.008865 ETH.
- Step 5
No activity retrieved: it is older than the lookup's window.
- Step 5
State found on Ethereum, Base, Arbitrum One, Optimism and Avalanche C-Chain.
- Step 6
0x1584a8…A3c7DD called 0x77EB52…295314.
- Step 6
The receipt holds 1,000 logs.
- Step 6
Events alone do not establish a swap or an actual balance change.
What others have reported8
- Step 1
$387.5M left Bitget in under three hours.Public reporting
- Step 2
The transfer was at 18:31 UTC and came from Bitget's hot wallet.Public reporting
- Step 2
No alert was raised on the test transfer.Public reporting
- Step 3
In the same hour the wallet received 12,852,046.24 USDC, 3,000.32 XAUT, and 7,130.86 and 13,965.93 ETH.Blockscout (public explorer)
- Step 6
A fake "ETH" token row and two look-alike addresses appear on the explorer.Blockscout (public explorer)
- Step 7
Funds went to four destination chains, about $269M of it through THORChain.Public reporting
- Step 8
The theft is attributed to North Korea.Chainalysis
- Step 8
The on-chain overlaps point to shared launderers, not necessarily the same attackers.BlockSec
Share and cite
Take the case with you.
The brief is one page: the steps, the timeline, every identifier, and which statements are recorded and which are reported.