The hacker responsible for Bitget's $387.5 million theft has withdrawn approximately $1.23 million in ether from Binance, according to blockchain analysis firm Lookonchain. The activity occurred two days before Bitget plans to reopen bitcoin withdrawals on September 28.
Lookonchain reported that wallet 0x4885 withdrew 257.6 ETH and 545,000 USDT from Binance on September 25. The attacker converted the stablecoin to an additional 200.2 ETH, then consolidated 457.9 ETH to the primary hacker address. Bitget and Binance have indicated they are collaborating to trace the stolen funds.
The breach, which occurred on September 24, compromised Bitget's wallet infrastructure. CEO Gracy Chen stated that attackers accessed a critical backend system and spoofed transaction data to trigger the exchange's authorization process. Bitget later raised its loss estimate to approximately $390 million after accounting for transfers on Zcash and Tron.
Phased Withdrawal Restart
Bitget has announced a phased schedule for reopening withdrawals, with all operations beginning at 08:00 UTC:
- September 28: Bitcoin (BTC)
- September 29: Ether (ETH) across multiple blockchains
- September 30: Tether (USDT) on select networks
- October 2: All other tokens and services
Trading and deposits continued throughout the incident, and Bitget states that user balances remain unaffected.
Protection Fund and Bitcoin Price Risk
Bitget's $5,500 BTC Protection Fund serves as the financial backstop for the loss. At bitcoin's current price of approximately $84,000, the fund holds roughly $462 million in value. The $387.5 million loss represents approximately 84 percent of the fund's current valuation.
The break-even point for the fund occurs at approximately $70,455 per bitcoin, roughly 16 percent below current prices. Bitget has not disclosed whether it would replenish the fund if bitcoin's price declines significantly.
Remaining Stolen Funds
Most frozen stablecoins remain inaccessible due to issuer lockdowns. However, blockchain data shows attackers still control over 63,000 ETH held in addresses that cannot be frozen, along with approximately $157 million in XRP. An additional $228 million was moved by attackers in 18 minutes, according to Arkham tracking.
