The hacker behind the Bitget breach withdrew $1.23 million from Binance, according to details of the incident that surfaced this week. The stolen funds were then funneled to a wallet controlled by the attacker. The withdrawal is a fresh reminder that crypto exchanges remain an attractive target for attackers — and that moving stolen assets through another exchange's rails is still possible.
Where the money actually went
The $1.23 million came out of Binance, not Bitget, which is the part of the story worth pausing on. The attacker didn't just drain Bitget and sit on the proceeds. They ran the funds through a second major exchange, then pushed them into a wallet they control. That flow matters because it shows how quickly stolen assets can change hands across venues with different compliance postures. Tracing them gets harder with every hop.
Bitget hasn't been named as the source of the Binance withdrawal in most public accounts. The line is simpler: a Bitget hacker withdrew from Binance. The funds ended up in an attacker-controlled wallet. That's it.
Security calls get louder
The incident has already triggered urgent calls for stronger security measures across exchanges and for international cooperation among the authorities who chase this kind of activity. Those calls aren't new — they surface after nearly every high-profile breach — but the cross-exchange element gives them more weight this time. If an attacker can drain one platform and cash out through another, the weak link isn't any single exchange. It's the connective tissue between them.
What that cooperation looks like in practice is still vague. Regulators and law enforcement in different jurisdictions move at different speeds, and crypto's cross-border nature means a transfer that takes seconds can take months to untangle.
The gap between detection and recovery
The Bitget hack highlights a familiar vulnerability: exchanges hold large pools of user assets, and those pools are worth attacking. Security teams have gotten better at spotting suspicious withdrawals in real time, but the window between a breach and a cash-out is often the only window that matters. Once funds land in an attacker-controlled wallet, recovery odds drop sharply.
Binance, for its part, hasn't said publicly whether the $1.23 million withdrawal was flagged at the time. The funds moved regardless. That's the part exchange security teams will be studying.
The immediate focus is on tracing the attacker-controlled wallet and determining whether the funds can be frozen or recovered. Whether that happens depends on where the money moves next, and on how quickly exchanges and authorities act together. For now, the $1.23 million is out — and the pressure on exchanges to close the gaps between them isn't going anywhere.
