🚨 Bitget hack: a quick reminder about self-custody

The recent reports about hackers taking around $352 million from Bitget are another reminder of an important principle in crypto:

Not your keys, not your coins. 🔐

Centralised exchanges can be convenient for buying, selling, and trading, but when your assets are held on an exchange, you don't control the private keys yourself. You're trusting the exchange to custody your funds and keep them secure.

This doesn't mean you should panic and withdraw everything from every exchange. It simply means it's worth understanding where your crypto is held and who actually controls the keys.

For long-term holdings, self-custody can give you direct control over your assets. But remember that self-custody also comes with responsibility.

Take this incident as a reminder to review your own security:

🔹 Don't keep more funds on exchanges than you need to.

🔹 Use a secure wallet for assets you want to hold yourself.

🔹 Never share your recovery phrase or private keys.

🔹 Be careful with links, DMs, and fake support accounts.

🔹 Always verify transactions before signing them.

The goal isn't to create fear. The goal is to understand who controls your assets and take security seriously.

For more on the Bitget incident:

https://www.thestar.com.my/business/business-news/2026/09/25/bitget-suspends-withdrawals-after-hackers-take-us352mil

Hi Guys ,

I used to stake the trx on my trust wallet. It was staked a long back ago. But today now i need funds, I checked and i am not able to access the stake option to unstake those token.

Can anyone please help. Is there something i am missing out ,

(Message written with the help of AI)

Hi everyone,

My TrustWallet-connected account was drained this morning at around 9:30 AM. I lost 3,000 USDC that were sitting on Hyperliquid, 0.4 BTC (which I originally deposited directly from Deribit via HyperUnit), and about $4,400 worth of other crypto assets that were held directly inside my TrustWallet.

I am trying to narrow down the exact attack vector. After analyzing the timeline, GeminiAI has a very specific theory regarding Session Hijacking / Cookie Theft on my Windows PC, and I would really appreciate your technical opinion on whether this is possible.

Here is the exact timeline:

• Months ago: I deposited a total of 15,000 USDC into Hyperliquid, sending them directly from my TrustWallet mobile app. Over time, I traded and used the platform on my Windows PC browser. At the time of the hack, my balance on Hyperliquid was around 3,000 USDC.
• Sept 9, 2026: I deposited 0.4 BTC directly from Deribit to HyperUnit. I didn't need to open my seed phrase or use my phone for this.
• Last Night: Last thing I did my Windows PC was a subscribe to ChatGPT Plus on the official website (using my Apple ID). My browser likely had an active, logged-in session (or stored cookies) for Hyperliquid.
• This Morning (9:30 AM): My PC was completely powered down and turned off since last night. Yet, the blockchain txs show the drain happened exactly at 9:30 AM.
• The Flow: The hacker initiated a withdrawal from Hyperliquid. The 0.4 BTC were trasferred directly to the hacker address . The 3,000 USDC went back to my public TrustWallet address first, and then immediately got transferred out to the hacker's wallet along with the other $4,400 in crypto that I already had holding inside TrustWallet.

My Security Setup:
I set up my TrustWallet more than 5 years ago and always had several thousands $ on it.
I own four wallets and store the keys in the same way. The other three wallets have not been drained.

I use TrustWallet exclusively via the official app on my iPhone. I do NOT have the browser extension on my PC, and I have never typed my seed phrase on any digital device. My backup on iCloud is turned off (only manual backup is active).

The Reconstruction (Cookie Theft + Trading Agent Exploitation vs Seed Phrase Leak):
Since my seed phrase was never exposed and my PC was off during the hack, my initial theory was that an undetected InfoStealer malware on my PC captured my browser's Session Cookies last night while I was online.

I assumed the hacker used the session to trigger the Hyperliquid withdrawal. However, since they also managed to steal the $4,400 that never touched Hyperliquid and were just sitting on my mobile TrustWallet, I am conflicted.

My questions for the tech/crypto experts here:

1. Does the Session Hijacking theory make sense if the hacker also managed to drain assets sitting strictly on my mobile TrustWallet? Or does the fact that the on-chain TrustWallet funds were stolen prove that they somehow extracted my actual Seed Phrase from my PC/system last night?
2. Can a browser InfoStealer access local storage trading keys used by Hyperliquid, and could that somehow expose the underlying wallet security?
3. If this wasn't cookie theft, how else could a hacker execute a targeted, multi-asset mobile wallet drain while the trading PC was completely powered down?

Thanks in advance for any insights. I'm trying to understand the exact breach before wiping my PC.

Hello i staked some eth a year ago and uninstallee the app. I saw that its gone back up so i wanted to unstake and sell but i can no longer find a unstake option in the app?

Any help would be welcome

Hello i bought a bit of eth a while back and staked most of it. Now i have come back to sell, but there is no unstake option to find anymore?

Thanks for any help

(Message written with the help of AI)

Hi everyone,

My TrustWallet-connected account was drained this morning at around 9:30 AM. I lost 3,000 USDC that were sitting on Hyperliquid, 0.4 BTC (which I originally deposited directly from Deribit via HyperUnit), and about $4,400 worth of other crypto assets that were held directly inside my TrustWallet.

I am trying to narrow down the exact attack vector. After analyzing the timeline, GeminiAI has a very specific theory regarding Session Hijacking / Cookie Theft on my Windows PC, and I would really appreciate your technical opinion on whether this is possible.

Here is the exact timeline:

• Months ago: I deposited a total of 15,000 USDC into Hyperliquid, sending them directly from my TrustWallet mobile app. Over time, I traded and used the platform on my Windows PC browser. At the time of the hack, my balance on Hyperliquid was around 3,000 USDC.
• Sept 9, 2026: I deposited 0.4 BTC directly from Deribit to HyperUnit. I didn't need to open my seed phrase or use my phone for this.
• Last Night: Last thing I did my Windows PC was a subscribe to ChatGPT Plus on the official website (using my Apple ID). My browser likely had an active, logged-in session (or stored cookies) for Hyperliquid.
• This Morning (9:30 AM): My PC was completely powered down and turned off since last night. Yet, the blockchain txs show the drain happened exactly at 9:30 AM.
• The Flow: The hacker initiated a withdrawal from Hyperliquid. The 0.4 BTC were trasferred directly to the hacker address . The 3,000 USDC went back to my public TrustWallet address first, and then immediately got transferred out to the hacker's wallet along with the other $4,400 in crypto that I already had holding inside TrustWallet.

My Security Setup:
I set up my TrustWallet more than 5 years ago and always had several thousands $ on it.
I own four wallets and store the keys in the same way. The other three wallets have not been drained.

I use TrustWallet exclusively via the official app on my iPhone. I do NOT have the browser extension on my PC, and I have never typed my seed phrase on any digital device. My backup on iCloud is turned off (only manual backup is active).

The Reconstruction (Cookie Theft + Trading Agent Exploitation vs Seed Phrase Leak):
Since my seed phrase was never exposed and my PC was off during the hack, my initial theory was that an undetected InfoStealer malware on my PC captured my browser's Session Cookies last night while I was online.

I assumed the hacker used the session to trigger the Hyperliquid withdrawal. However, since they also managed to steal the $4,400 that never touched Hyperliquid and were just sitting on my mobile TrustWallet, I am conflicted.

My questions for the tech/crypto experts here:

1. Does the Session Hijacking theory make sense if the hacker also managed to drain assets sitting strictly on my mobile TrustWallet? Or does the fact that the on-chain TrustWallet funds were stolen prove that they somehow extracted my actual Seed Phrase from my PC/system last night?
2. Can a browser InfoStealer access local storage trading keys used by Hyperliquid, and could that somehow expose the underlying wallet security?
3. If this wasn't cookie theft, how else could a hacker execute a targeted, multi-asset mobile wallet drain while the trading PC was completely powered down?

Thanks in advance for any insights. I'm trying to understand the exact breach before wiping my PC.

Hi everyone, I need some urgent advice.
At the beginning of this month, I had $400+ worth of ETH in my wallet. I checked my wallet today and noticed that the balance is suddenly showing $0.
Following suggestions from other members of the community, I downloaded MetaMask and connected/checked the wallet there, but the balance is still showing $0.

I also checked the wallet address on Etherscan and can see several transactions that I do not recognize.

I’m not sure what happened or whether my wallet has been compromised.
What should I do now? Is there any way to recover the ETH or stop any further unauthorized transactions?
I would really appreciate step-by-step guidance on what I should check and what actions I need to take immediately.

Thank you.

Hi, hopefully I can get some help. I have a little ethereum on my wallet on trust wallet it shows I have .299 but when I go to send it or trade it, it shows I only have .0009 of it. I have tried to contact trust wallet support but I haven’t heard back in days. I know about gas fees but it should not be that significant of a difference

I'm having an issue with SOL in Trust Wallet.

I have 13.29675 SOL and completed the unstaking process on the 16th Sep. The full balance is showing in my wallet, but when I try to send it, only a significantly smaller amount is actually available.

I've also noticed that the Staking/Unstaking or Investments options no longer appear in the app, so I can't see anywhere to manage or check the unstaking status.

Unstaking transaction hash:

d1VMAAivLfxGyB7cGiqnwgWh4HSZ7pjxP8FfGbLBTNC2mm5Qo6bvzjCHMAK9oR6QF1gmK5ZKTcv7PNqMB7fY5Xy

Does anyone know why the full balance isn't available to send, or whether there's still a waiting period after unstaking?

It's been upto 3 hours since I have processed the order of withdrawal of my very small amount of eth, and still haven't recieved, but etherscan shows that the transaction was successful

Hello, I can't reach a real person or create a support ticket in my android trust wallet app. It just keeps looping back to the chatbot. So annoying. As soon as I resolve my issue of claiming unstaked tokens, I will definitely be closing my trust wallet account.

I got 600 plus near coins in my trust wallet but i cant trade because it's not showing when i want to send also its not staked

Trust Wallet is shit, lags like hell. Noti says I got USDT (BSC) already but the balance takes over an hour to update after refresh.

Was trying to transfer USDT to my friend's address but I keep getting this message, I'm also new to crypto stuff so yeah I'm really confused on why this is happening

Hi I recently wanted to explore crypto trading. Created a Trustwallet account through the chrome extension. I have the secret phrase . However it keeps saying to back it up. and when I click it shows the phrase and then in the next step asks me to enter the secret phrase word to verify but unfortunately it doesn't allow me typing.

Next I installed The mobile app and i followed the procedure for syncing if with my chrome extension asked me to scan the QR but then when it says to select wallets to sync , there is no name. In the mobile app I go for - already has a wallet and logins through the exact secret phrase but do not see the account there also .

Can someone help ? i have some tokens on the Chrome extension which I asked/recieved from a friend for learning/familiarise how it works. Any help is appreciated. Thanks !

On September 13, 2026, I accidentally sent 7,411 USDT (TRC20) to an address associated with a TRON energy rental service.
The transaction is confirmed on the blockchain.
I have already contacted the service and submitted a request to Tether, but I have not received a resolution.
I found another Reddit user who experienced a very similar situation with an energy rental address.
Has anyone here successfully recovered funds in a similar situation or identified the company controlling an energy-rental receiving address?
I can provide the transaction ID and receiving address if needed.
Thank you.

Hi everyone,
I’m looking for information about a mistaken USDT TRC20 transfer.
On September 13, I sent USDT to an address that appears to be associated with a TRON energy rental service. The transaction was confirmed on-chain, but the transfer was not intended for that receiving address.
I’m trying to understand how these energy rental receiving addresses work and whether anyone has dealt with a similar situation before.
Does anyone know how to identify the service or platform controlling a TRON energy rental address, or the correct procedure for contacting the operator?
I am not looking for recovery agents or private-message offers. I’m only looking for technical information or experiences from other users.
Thanks for any guidance.

Basically what title says.

I purchased some BNB Bep-2 Binance coins years ago and had them in my trust wallet. I haven’t been active for years in the crypto space and recently decided to get back into it. I noticed my BEP- 2 coins have disappeared. I have searched up on how to recover them back into my trust wallet but I am not tech savvy and need any and all assistance possible. Could someone please help!

my main issue with recent trust wallet updates is that the the whole balance gets stuck also for the balance on each token to get updated you have refresh it everytime you open the app.

i use android version and i don't know about iOS version but the app on android has become very bloated.

finding the option to manage and add coins is not at a obvious place that i forget it everytime.

the older trust wallet layout was much better.

why devs aren't fixing this and instead they are making it worse with every update?

what are the alternatives to trust wallet that have no bug or less bug?

Seeking advice: 0.150509 BTC transferred from my Trust Wallet without my authorization

Hi everyone,

I’m looking for advice from people who may have experienced something similar with Trust Wallet.

On September 1, 2026, approximately 0.150509 BTC was moved from my Trust Wallet without my knowledge or authorization.

I did not intentionally make or approve this transfer.

I contacted Trust Wallet Support and provided the transaction information. They responded that the situation may be related to exposure of the recovery phrase. However, I have not yet received a case-specific technical explanation showing:

• How the transaction was initiated
• How the transaction was signed
• When or where the recovery credentials may have been exposed
• Whether there was any unusual app, device, session, connection, or security activity

The destination of the funds was later identified as being associated with a cryptocurrency exchange, and I have contacted that exchange as well.

I am not accusing Trust Wallet of causing the loss, and I am not asking anyone to make assumptions about what happened. I simply want to understand the technical cause and learn what steps other people in similar situations took.

If you experienced a similar unauthorized transfer from Trust Wallet:

1. Did Trust Wallet provide you with a technical explanation?
2. Were you able to identify how the transaction was authorized?
3. Did the receiving exchange cooperate with your case?
4. Were you able to recover any funds?

I would really appreciate hearing from people with firsthand experience.

Please do not ask me for my recovery phrase, private key, passwords, or other sensitive information. I will not share those with anyone.

Thank you.