Bitget users moved thousands of Bitcoin shortly after the exchange restored withdrawals following a $387.5 million security breach, providing an early indication of customer confidence after four days of suspended services.
Bitget Chief Executive Gracy Chen said the exchange had processed 9,585 withdrawal orders worth 4,098.036 BTC by 17:00 UTC+8 on Sept. 28, after Bitcoin withdrawals resumed. Separate DeFiLlama data showed that Bitcoin held in wallets attributed to Bitget fell from 35,412 BTC to about 30,770 BTC—a reduction of roughly 4,642 BTC. At prevailing prices, that was equivalent to about $391 million.
According to CryptoSlate, the decline in tracked reserves was larger than the withdrawals reported by Chen. That difference does not necessarily mean additional customer withdrawals: DeFiLlama’s figures are based on assets held in wallets identified as belonging to exchanges, so wallet reorganizations, transfers between addresses and changes in address coverage can affect the total. Even so, the sharp drop is the first visible market response since Bitget reopened access after its biggest security incident in eight years.
Bitget begins phased return of withdrawals
Bitcoin withdrawals resumed at 08:00 UTC on Sept. 28 after the exchange said it had completed additional checks on its withdrawal infrastructure. Bitget plans to restore services in stages:
- Ethereum withdrawals are scheduled for Sept. 29.
- USDT withdrawals are scheduled for Sept. 30.
- Remaining tokens, fiat services and peer-to-peer transactions are scheduled to return on Oct. 2.
The exchange has said the attack did not compromise its private keys or cold-wallet reserves. Chen said an internal investigation found that attackers exploited vulnerabilities in third-party products to obtain internal credentials. Those credentials were then used to submit fraudulent withdrawal instructions that bypassed Bitget’s risk controls.
Bitget said it isolated the affected systems, revoked and reissued internal credentials, and changed how access to sensitive infrastructure is managed. The exchange also disabled the affected third-party functionality while the vendor works on a fix. Mandiant and SlowMist are assisting with forensic work and efforts to follow the stolen assets.
Bitget has pledged that customers will not absorb losses from the incident. The company said its Protection Fund would cover the shortfall, while Chen said Bitget intends to replenish the fund with its own capital to more than $300 million within a week.
Stolen assets move across chains and privacy tools
Recovering the funds is becoming more difficult as the stolen cryptocurrency is divided among multiple networks, bridges, cross-chain services and privacy tools. Blockchain investigator ZachXBT said Chinese illicit actors were laundering proceeds for hackers he described as allegedly linked to North Korea. He reported that the funds were being moved between chains and deposited into mixing services, including Wasabi.
ZachXBT also connected one participant in the alleged laundering network to transactions following the $292 million Kelp DAO exploit earlier this year. He said the behavior resembled activity observed after other attacks attributed to the TraderTraitor campaign.
The movement of Bitget-linked funds has brought THORChain into a dispute over whether permissionless infrastructure should intervene when stolen assets pass through its system. THORChain says it should not selectively block wallets or swaps, comparing its position with the censorship resistance associated with networks such as Bitcoin and Ethereum.
Security firm GoPlus disputes that comparison. It says THORChain’s threshold-signature vaults require active nodes to jointly authorize outgoing transfers, while per-chain signing halts, network-wide pauses and Mimir governance provide mechanisms for coordinated intervention. In GoPlus’s view, the key issue is therefore not whether THORChain has emergency controls, but when its operators choose to use them.
GoPlus also cited THORChain’s response to a $10.7 million exploit affecting the network in May, when the protocol was halted during containment efforts. The firm argued that similar tools could be used against addresses associated with the Bitget attackers. THORChain responded that halting the network to protect the protocol is different from censoring a specific wallet, user or swap, and said attacker addresses were not blacklisted during the May incident.
GoPlus estimated that around 101.5 BTC, worth approximately $8.5 million, had already left through THORChain from the Bitget exploit. It also said 27.63 million XRP, valued at roughly $43 million, was being converted into Bitcoin. The firm further pointed to THORChain’s role in processing funds from the 2025 Bybit hack and argued that fees from such activity could create a conflict for operators who decline to intervene. THORChain has not accepted that characterization.
Moneyiar market picture
Moneyiar data recorded Bitcoin at $83,820.048202442 as of Sept. 25 at 22:04 +03:30. BTC was down 0.61% over 24 hours but up 3.2% over seven days.
Other tracked assets were mixed but mostly higher over the seven-day period. Filecoin stood at $1.0332232605 as of Sept. 25 at 22:03 +03:30, gaining 3.56% in 24 hours and 12.32% over seven days. NEAR Protocol was $4.9081066872, up 6.57% and 30.49%, respectively. OriginTrail was $0.3767661846, up 1.25% over 24 hours and 10.53% over seven days.
As Bitget continues restoring Ethereum, USDT and other services, investigators face the challenge of tracing funds that are already fragmented across networks and routed through protocols whose operators may resist transaction-level intervention.
