Bitget Restores BTC Withdrawals as Hacker Moves ETH via THORChain

Bitget resumed Bitcoin withdrawals on Monday after a Sept. 24 security breach that affected roughly $387.5 million in crypto assets. The exchange said parts of its hot and warm wallet infrastructure were accessed, while its cold wallets remained secure.

The company first estimated the loss at $351.6 million and later raised the figure to $387.5 million after tracing additional transfers on Zcash and Tron. Withdrawals were suspended immediately after the incident to allow security checks; Bitget has been restoring services in phases.

Bitcoin withdrawals on the Bitcoin network and the BNB Smart Chain were restored first. During an ask‑me‑anything session, CEO Gracy Chen noted, ‘We restored BTC first because the withdrawal pipeline is the first to be completed.’ Bitget said Ether withdrawals are scheduled to resume on Tuesday across Ethereum, BNB Smart Chain, Arbitrum, Base and Optimism. Tether (USDT) withdrawals are set to resume Wednesday on Ethereum, BNB Smart Chain, Solana and Tron. Withdrawals for other tokens and peer‑to‑peer services are expected to return on Friday. The company said the schedule applies to all users equally, with no priority access for institutions, VIPs or employees.

On‑chain monitoring shows the attacker converting some of the stolen Ether into Bitcoin through THORChain. Observers reported funds flowing into THORChain vaults and swaps taking place across the protocol. Bitget has urged THORChain to refuse services to addresses it has linked to the theft while it traces outflows.

THORChain responded that a network halt is an emergency security measure that affects the protocol broadly and ‘is not a selective freeze of specific funds or an individual swap.’ Operators and analysts note that the protocol can pause trading, stop outbound transactions or pause a connected chain, but it does not maintain a built‑in address blacklist, which limits the ability to block individual addresses without disrupting other users.

Bitget said it continues security checks before reopening all withdrawal services. Investigations and on‑chain monitoring are ongoing as the exchange and blockchain analysts track the movement of the stolen assets.