Bitget lost $387.5 million in the largest security breach of its eight-year history, the exchange confirmed after freezing withdrawals for four days. Bitcoin withdrawals went live again at 08:00 UTC on Sept. 28, and CEO Gracy Chen said the platform had processed 9,585 withdrawal orders totaling 4,098.036 BTC by 17:00 UTC+8 that day.
The number that matters most sits with DeFiLlama: Bitget's tracked Bitcoin balance dropped from 35,412 BTC to about 30,770 BTC — a decline of roughly 4,642 BTC, or around $391 million at prevailing prices. That gap is larger than the figure Bitget has publicly put on the incident, though the exchange says customers will bear no losses.
What actually got breached
Not the private keys. Not the cold wallets. Bitget's internal trace found attackers exploited vulnerabilities in third-party products to obtain internal credentials, then used those credentials to push fraudulent withdrawal instructions past the exchange's risk controls. The company isolated affected systems, revoked and reissued credentials, restructured access to sensitive infrastructure, and disabled the compromised third-party function while the vendor works on a fix. Mandiant and SlowMist are handling forensics and asset tracing.
The unwind schedule
Bitcoin is back. Ethereum withdrawals are set for Sept. 29, USDT for Sept. 30, and everything else — remaining tokens, fiat, peer-to-peer — for Oct. 2. The staggered restart is a controlled reopening, not a full all-clear. Chen said she plans to top up the exchange's Protection Fund with company capital to more than $300 million within a week, which is the pool meant to absorb the shortfall.
Where the money went
Blockchain investigator ZachXBT said Chinese illicit actors are laundering the proceeds on behalf of hackers he described as allegedly linked to North Korea. The stolen funds have been chain-hopped and deposited into mixing services including Wasabi. A TRM and ZachXBT flow map traces the exploit funds through multiple intermediary wallets, with transfers heading toward THORChain.
ZachXBT tied one participant in the laundering network to movements that followed the $292 million Kelp DAO exploit earlier this year, and noted similar behavior after several attacks attributed to the TraderTraitor campaign. The pattern — mixers, cross-chain swaps, rapid hops — is familiar enough that the tracing firms appear to have the route mapped already.
THORChain won't block, GoPlus says it could
THORChain says it will not selectively block wallets or swaps, arguing its role is comparable to censorship-resistant networks like Bitcoin and Ethereum. GoPlus pushed back, saying THORChain's architecture gives node operators powers that base-layer validators simply do not have. The security firm cited threshold-signature vaults, per-chain signing halts, network-wide pauses, and Mimir governance as evidence that operators can coordinate intervention when they choose.
GoPlus pointed to THORChain's own response to a $10.7 million exploit in May, when the network was halted as part of containment, arguing the same emergency framework could be aimed at addresses linked to the Bitget attackers. THORChain disputes that, saying a network halt exists to protect the protocol itself, not to police external flows.
Ethereum withdrawals open Sept. 29, followed by USDT on Sept. 30 and the rest on Oct. 2. The unresolved question is whether THORChain's node operators will keep declining to intervene as traced funds continue moving through their swaps — and whether Bitget's Protection Fund top-up lands before the remaining token withdrawals go live.
