Key points

• Bitget restarted Bitcoin withdrawals on Monday, September 28, 2026, on the Bitcoin network and BNB Smart Chain.
• The exchange raised its loss estimate to $387.5 million from $351.6 million after extra transfers on Zcash and Tron.
• CEO Gracy Chen said the timetable applies to all users, with no priority for institutions, VIPs or staff.
• Coinpedia reported the attacker moved roughly $4 million to $4.5 million through THORChain and converted it into Bitcoin.
• Tether and Circle froze 218,023 USDT and 99,990 USDC, worth about $318,000 combined, from an attacker-linked address.

Bitget has resumed Bitcoin withdrawals after a September 24 breach, the first step in restoring services at the exchange, which now puts the loss at $387.5 million, Cointelegraph reported. The Bitget withdrawals restart came on Monday, September 28, 2026, on the Bitcoin network and BNB Smart Chain, according to the exchange.

CEO Gracy Chen said during a Monday ask-me-anything session that BTC moved first because its withdrawal pipeline was completed first. She said asset balances and account data remain accurate. Bitget had suspended customer withdrawals after detecting unauthorised transfers from part of its hot and warm wallet infrastructure. Cold wallets were not compromised, the exchange said.

Bitget revised the stolen amount to $387.5 million from an earlier figure of $351.6 million after accounting for additional transfers on Zcash and Tron. Ether withdrawals were set for Tuesday across Ethereum, BNB Smart Chain, Arbitrum, Base and Optimism. USDT was due on Wednesday across Ethereum, BNB Smart Chain, Solana and Tron, with other assets and peer-to-peer services on Friday. Chen said the schedule applies to all users, with no priority access for institutions, VIP customers or Bitget employees.

Bitget restores BTC access

Blockchain security firms TRM Labs and SlowMist's MistTrack tracked the stolen funds moving across networks, according to Coinpedia. Coinpedia reported that the attacker moved roughly $4 million to $4.5 million of the stolen $387.5 million through THORChain and converted it into Bitcoin. Chen publicly asked THORChain validators to refuse service to addresses tied to the attackers, arguing that decentralisation is a design principle rather than a shield for known stolen funds.

THORChain declined, describing itself as a decentralised, permissionless network similar in design to Bitcoin and Ethereum. It said its network halt is an emergency security mechanism affecting the protocol broadly, not a selective freeze of particular funds or an individual swap. Crypto author Anndy Lian said THORChain can halt trading, stop outbound transactions or pause a connected chain, but those measures hit users broadly, and the protocol has no built-in address blacklist. Critics including SlowMist founder Cosine argued the network could do more, pointing to past incidents when THORChain developers used a red button to pause the network during an exploit.

Coverage elsewhere frames the case around stablecoin issuers as well. Crypto.news cited security researcher Taylor Monahan, who flagged transfers and swaps tied to the attacker and questioned why the funds stayed movable despite Circle's ability to block transfers from specific USDC addresses. Circle has said it exercises its freeze ability when legally compelled by an appropriate authority, and its terms reserve the right to block addresses it determines may be linked to illegal activity. Coinpedia reported that the hackers first swapped stolen USDT and USDC into ETH and BNB to avoid freezes, but that Tether and Circle still froze 218,023 USDT and 99,990 USDC worth about $318,000 combined from an attacker-linked address.

Loss estimate rises

On-chain tracker Lookonchain put the stolen portfolio at roughly $356.8 million using prices at the time of its update, a different measurement from Bitget's internal loss figure, Crypto.news noted. The sequence shows how quickly a centralised exchange can restore partial service after a large breach, while the funds keep moving through infrastructure its operator cannot unilaterally control. For Bitget users, access to BTC on two networks returned first, with other assets following on a published timetable that does not favour large clients. The standoff over THORChain's role puts a spotlight on whether permissionless cross-chain swaps should carry any responsibility when identifiable stolen assets pass through them, and it tests the practical limits of stablecoin freezing once assets have been converted.

Read the full article on Coinpulsehq →