Nearly 5,000 Bitcoin has left Bitget's tracked reserves after the cryptocurrency exchange reopened withdrawals following a $387.5 million hack.
On September 28, Bitget CEO Gracy Chen said the exchange had processed 9,585 withdrawal orders totaling 4,098.036 BTC as of 17:00 UTC+8, shortly after resuming Bitcoin withdrawals. According to DeFiLlama tracking data, Bitget's Bitcoin balance fell to approximately 30,770 BTC from 35,412 BTC, a decline of roughly 4,642 BTC. At prevailing prices, this drop represents about $391 million of Bitcoin.
The reserve decline exceeded the amount of customer withdrawal orders Chen reported. DeFiLlama tracks assets held in exchange wallets, and balance changes can reflect wallet movements and address coverage differences in addition to customer withdrawals.
Security Response and Asset Recovery
Bitget restored Bitcoin withdrawals on September 28 after completing additional checks on its withdrawal infrastructure. Ethereum withdrawals were scheduled to resume on September 29, USDT on September 30, and remaining tokens, fiat, and peer-to-peer services on October 2.
Chen stated that an internal investigation found attackers exploited vulnerabilities in third-party products to obtain internal credentials, which were then used to submit fraudulent withdrawal instructions that bypassed Bitget's risk controls. The exchange isolated affected systems, revoked and reissued internal credentials, and restructured access to sensitive infrastructure. Bitget also disabled the affected third-party functionality while the vendor works on a fix.
Blockchain security firms, including Mandiant and SlowMist, are assisting with forensic analysis and tracing stolen assets. Bitget stated that customers will bear no losses from the incident, and its Protection Fund will cover the shortfall. The company plans to replenish the fund with its own capital to more than $300 million within a week.
Laundering Activity and Protocol Debate
Recovering stolen funds is becoming more difficult as assets are being fragmented across bridges, cross-chain protocols, and privacy services. Blockchain investigator ZachXBT reported that Chinese illicit actors were laundering proceeds from the exploit through mixing services including Wasabi. ZachXBT also linked one participant in the laundering network to movements following the $292 million Kelp DAO exploit earlier in the year.
The laundering activity has put THORChain at the center of a dispute over whether permissionless infrastructure should intervene when stolen assets pass through its systems. THORChain has stated it would not selectively block wallets or swaps, arguing its role is comparable to censorship-resistant networks such as Bitcoin and Ethereum.
Blockchain security firm GoPlus challenged this comparison, pointing to THORChain's threshold-signature vaults, where active nodes jointly authorize outbound transfers, and its ability to implement per-chain signing halts and network-wide pauses. GoPlus estimated that approximately 101.5 BTC, worth roughly $8.5 million, had already exited through the protocol from the Bitget exploit, while another 27.63 million XRP, valued at about $43 million, was being converted into Bitcoin.
THORChain maintains that a network halt is meant to protect the protocol itself and differs from selectively censoring a particular user, wallet, or swap. The protocol has stated that attacker addresses were not blacklisted during its own May exploit, maintaining that the protocol should remain neutral even when known stolen funds move through it.
