Bitget loses control of $351.6M

This week Bitget confirmed unauthorized transfers involving part of its hot and warm wallet infrastructure. The number eventually disclosed by the exchange was MASSIVE: $351.6M affected. The onchain trail was also pretty interesting.

Funds converged on:
0x770b10b273fC44Fe9197D6bF20F145c2e98463Ee and were then dispersed across six different EVM addresses.

One of those wallets immediately caught my attention:
0xe410a2E5710Ee787bcaa63f52A3943ff71F0d946, it took $19.67M in USDT0 and bought 7,111 ETH on Arbitrum in JUST six minutes.

The execution was horrible.

The wallet appeared willing to pay a massive premium simply to convert the funds as quickly as possible, which tells you quite a lot about the urgency of whoever controlled them, even if it tells us nothing definitive about who was behind the incident.

Bitget responded by temporarily suspending withdrawals while keeping deposits and trading operational. The exchange said user balances remained correct, cold wallets were unaffected, relevant addresses had been flagged and law enforcement had been contacted.

It also pointed toward its User Protection Fund, valued at $464M, as protection for users.

There is still a pretty important unanswered question here, but I’m actually more interested in what this should teach us, because every few months crypto gives everyone the same lesson and then we collectively forget it.

FTX taught it in 2022. Bybit taught it last year. Bitget is teaching another version of it.

Where you store your money is part of the trade.

I use centralized exchanges (I’m not going to pretend I don’t), they’re useful for fiat, liquidity, execution and a hundred other things. But leaving your entire portfolio permanently sitting on any exchange means accepting counterparty risk that has absolutely nothing to do with whether your investment thesis was correct.

You can predict the market perfectly and still lose money because somebody else controlled the keys. Remember, not your keys, not your crypto.

Self-custody introduces its own risks too, we have seen many cases this year, lose your seed phrase, sign something malicious, approve the wrong contract or get drained and there may be nobody coming to reimburse you.

Understand where your money is, who can move it and what has to fail for you to lose it. Split risk when the amount becomes important enough, keep money you actively trade where you actually need it. Think twice about where the rest sits.

Stay safe, always.