Bitget resumes Bitcoin withdrawals after $388m hack
Bitget has restarted Bitcoin withdrawals and set a timetable for other assets after a breach that affected about $388 million, while the attacker swaps stolen Ether through THORChain.
Key points
- Bitget resumed Bitcoin withdrawals on Monday, having suspended them after the Sept. 24 breach.
- The exchange raised its estimate of affected assets from $351.6 million to $387.5 million after extra Zcash and Tron transfers.
- Ether withdrawals are due Tuesday across Ethereum, BNB Smart Chain, Arbitrum, Base and Optimism, with USDT on Wednesday.
- CEO Gracy Chen said the schedule applies to all users, with no priority for institutions, VIPs or staff.
- THORChain said its network halt is a broad emergency mechanism, not a selective freeze of specific funds.
Bitget has resumed Bitcoin withdrawals after a security breach that affected nearly $388 million in assets, as the attacker continues moving stolen crypto through THORChain, CoinTelegraph reports. The exchange said it restarted Bitcoin withdrawals on Monday, having suspended them following last week's incident, with more assets and networks to follow over the coming days.
According to the exchange, the Sept. 24 breach compromised part of its hot and warm wallet infrastructure, while its cold wallets remained secure. Bitget later revised the stolen amount from $351.6 million to $387.5 million after accounting for additional transfers on Zcash and Tron.
Bitcoin withdrawals on the Bitcoin network and the BNB Smart Chain resumed first, Bitget CEO Gracy Chen said during a Monday ask-me-anything session. She said the exchange restored BTC first because the withdrawal pipeline was the first to be completed, adding that Ether and Tether's USDt would follow as security checks progress.
Withdrawals restart after breach
Under the schedule Bitget announced, Ether withdrawals are set to resume on Tuesday across Ethereum, BNB Smart Chain, Arbitrum, Base and Optimism. USDT withdrawals are due on Wednesday across Ethereum, BNB Smart Chain, Solana and Tron, while withdrawals for other assets and peer-to-peer services are scheduled to return on Friday.
Chen said the schedule applies to all users, with no priority access for institutions, VIP customers or Bitget employees. She has also called on THORChain, a decentralised protocol for swapping assets between blockchains, to refuse services to addresses linked to the attack.
Lookonchain reported on Monday that the attacker was swapping Ether for Bitcoin through THORChain, while Arkham data showed ETH linked to the attacker flowing into THORChain vaults. THORChain said on Monday that its network halt is an emergency security mechanism affecting the protocol broadly and is not a selective freeze of specific funds or an individual swap.
Schedule for Ether and USDT
Crypto author Anndy Lian said THORChain can halt trading, stop outbound transactions or pause a connected chain, but those measures affect users broadly. The protocol has no built-in address blacklist, he said, which limits its ability to block specific addresses. The episode highlights the difficulty of freezing stolen funds once they move through decentralised cross-chain infrastructure.