Bitget has resumed Bitcoin withdrawals, the first step in restoring services after a hack last week that cost the exchange $388 million. Ether withdrawals are set to return on Tuesday, with USDt following on Wednesday.
The exchange has been running on partial functionality since the breach. Bitcoin is the first asset back online, which gives users at least some ability to move funds while the rest of the withdrawal stack stays closed.
A hack, and a $388M hole
The breach cost Bitget $388 million, a figure that puts it among the larger exchange losses of the year. The attacker didn't sit on the funds. They swapped ETH through THORChain, a cross-chain swap protocol that lets users move assets between networks without a centralized intermediary.
That routing matters. THORChain swaps don't depend on a single custodian, so the ETH moved along a path that's harder for any one exchange or issuer to freeze. It's a familiar playbook for attackers who want to break the on-chain trail quickly.
Why the rollout is staged
Bitget isn't flipping everything back on at once. Bitcoin first, Ether on Tuesday, USDt on Wednesday. That sequencing is common after a security incident: each asset runs on its own infrastructure and its own set of checks, and re-enabling them one at a time lets the exchange verify balances and hot-wallet behavior before opening the next gate.
USDt being last is worth noting. Stablecoin withdrawals tend to carry the heaviest volume, and they're the first thing users reach for when they want out. Putting them at the end of the queue keeps the load off the system while the earlier assets are still being tested.
What users are watching
For Bitget account holders, the practical question is simple: when can they get their funds out. Bitcoin is live now. Ether is promised for Tuesday, USDt for Wednesday. Those are the dates the exchange has put on the record.
The other question — whether the $388 million is covered, and how — hasn't been answered in the facts available. Exchange hacks often end with a mix of recovered funds, insurance, and a hole the company absorbs. Which of those applies here isn't yet clear.
The THORChain angle
The attacker's use of THORChain for the ETH swap points to a broader trend in how these incidents play out. Cross-chain swap venues give attackers a way to convert stolen assets without touching a centralized exchange's order books, which is where most frozen-funds stories begin and end.
That doesn't mean the funds are gone for good. It means the recovery path, if there is one, runs through different channels than a standard exchange freeze.
Wednesday is the next real checkpoint. If USDt withdrawals come back on schedule, Bitget will have restored its full withdrawal set within a week of the breach. If they slip, users will have their answer about how deep the damage goes.
