Key points

• Lookonchain reported wallet 0x4885 withdrew 257.6 ETH and 545,000 USDT from Binance on Sept. 25, swapping the USDT for 200.2 ETH and sending 457.9 ETH, about $1.23m, to the Bitget hacker's address.
• Bitget raised its loss estimate from $351.6m to about $390m after counting transfers on Zcash and Tron, and says its flaw is fixed.
• Bitcoin withdrawals reopen Sept. 28, followed by ETH on Sept. 29, USDT on Sept. 30 and all other assets by Oct. 2, each phase starting at 08:00 UTC.
• Bitget's 5,500 BTC Protection Fund is worth about $462m at roughly $84,000 per bitcoin, covering the loss while BTC stays above about $70,455.
• CEO Gracy Chen said the attacker compromised a critical backend system, spoofed transaction data and triggered the authorisation process; she linked the IP patterns to North Korea-aligned hackers.

A wallet tied to the Bitget hacker pulled about $1.23 million in ether out of Binance, two days before the exchange reopens bitcoin withdrawals on Monday. Blockchain sleuth Lookonchain flagged the transfers, which Bitcoin.com News reported. The withdrawals were spread across several separate transfers on Sept. 25.

Lookonchain said wallet 0x4885 withdrew 257.6 ETH, worth about $692,000, and 545,000 USDT from Binance. The wallet then swapped the USDT for another 200.2 ETH and sent all 457.9 ETH, roughly $1.23 million, to the Bitget hacker's address. Bitget and Binance have said they are working together to trace the stolen funds, and a Binance withdrawal usually leaves a verified account behind for investigators.

The amount is small next to the haul. Bitget raised its loss estimate from $351.6 million to about $390 million after counting transfers on Zcash and Tron. CEO Gracy Chen said the attacker compromised a critical backend system inside the exchange's wallet infrastructure, used it to spoof transaction data and triggered the authorisation process to move funds out. In plainer terms, Bitget's own approval system signed off on the theft.

Hacker refuels through Binance

Bitget says the flaw is now fixed and has published a phased withdrawal schedule. Trading and deposits never stopped, and the exchange says user balances are unaffected. Every phase opens at 08:00 UTC: bitcoin first, then ether on Ethereum, BNB Smart Chain, Arbitrum, Base and Optimism on Sept. 29, tether on Ethereum, BSC, Solana and Tron on Sept. 30, and all other tokens, fiat and peer-to-peer services on Oct. 2.

Onchain analyst Yu Jin pointed out that the order is not random. Bitget's Protection Fund is held entirely in BTC, so opening bitcoin first nudges impatient users to swap holdings into BTC on the platform and withdraw it. If they do, Bitget can pay withdrawals straight from its reserve without selling coins on the open market.

That makes the bitcoin price a solvency question for Bitget rather than just a market story. The exchange's August report lists the fund at 5,500 BTC, with an August average value of $382 million. At bitcoin's current price of roughly $84,000, those coins are worth about $462 million, matching Chen's claim that the fund covers the full loss. The $387.5 million loss equals about 84% of the fund at today's price, putting break-even near $70,455 per BTC, about 16% below the current level. Bitget has not said whether it would top up the fund if bitcoin slides.

Bitcoin withdrawals go first

Most of the loot remains out of reach. Circle and Tether have frozen the wallet labeled "Bitget Exploiter 8", but Misttrack data shows other attacker addresses still holding more than 63,000 ETH, which no issuer can freeze. The largest single chunk, about $157 million in XRP, sits in wallets that cannot be frozen either. Arkham tracked the attackers moving $228 million in 18 minutes, and Chen told reporters that IP patterns and onchain signatures point to North Korea-linked hackers, the same playbook behind the Bybit theft in 2025.

Read the full article on Bitcoin.com News →