Nearly 5,000 BTC leaves Bitget as hackers begin laundering $387.5 million haul

Bitget's tracked Bitcoin balance fell by about 4,642 BTC after withdrawals resumed following the $387.5 million hack. DeFiLlama data showed the balance declining from 35,412 BTC to about 30,770 BTC. At prevailing prices, the decline represented about $391 million in Bitcoin. On Sept. 28, CEO Gracy Chen said Bitget had processed 9,585 withdrawal orders totaling 4,098.036 BTC by 17:00 UTC+8. The tracked reserve decline exceeded the Bitcoin amount Chen said Bitget had processed through customer withdrawal orders. DeFiLlama tracks assets in wallets attributed to exchanges. Its balance changes can also reflect wallet movements or differences in address coverage rather than customer withdrawals alone. The rapid outflow provided the first indication of user response after Bitget froze withdrawals for four days while investigating the largest security incident in its eight-year history. Bitget restored Bitcoin withdrawals at 08:00 UTC on Sept. 28 after additional checks on its withdrawal infrastructure. Ethereum withdrawals were scheduled to resume on Sept. 29. USDT withdrawals were scheduled for Sept. 30. Other token withdrawals and fiat and peer-to-peer services were scheduled for Oct. 2. Bitget sought to reassure customers that the attack had not compromised its private keys or cold-wallet reserves. Chen said a completed internal trace found that attackers exploited vulnerabilities in third-party products to obtain internal credentials. Chen said the attackers then used those credentials to submit fraudulent withdrawal instructions that bypassed Bitget's risk controls. Chen said Bitget had isolated affected systems. She said the exchange had revoked and reissued internal credentials and restructured access to sensitive infrastructure. Bitget disabled the affected third-party functionality while the vendor works on a fix. Mandiant and SlowMist were among the blockchain security firms assisting with forensic analysis and attempts to trace the stolen assets. Bitget had previously said the incident involved a critical backend system in its wallet infrastructure. The exchange said it had fixed the vulnerability before withdrawals resumed. Bitget said customers would bear no losses from the incident. The company said its Protection Fund would cover the shortfall. Chen said Bitget plans to use its own capital to replenish the fund to more than $300 million within a week. Recovering the stolen funds was becoming more difficult as the assets were fragmented across bridges, cross-chain protocols and privacy services. Investigator ZachXBT said Chinese illicit actors were laundering proceeds from the exploit on behalf of hackers he described as allegedly linked to North Korea. ZachXBT said the funds were moving across chains and entering mixing services including Wasabi. ZachXBT linked one participant in the laundering network to movements following the $292 million Kelp DAO exploit earlier this year. He said he had seen similar behavior after several attacks attributed to the TraderTraitor campaign. The laundering activity placed THORChain at the center of a dispute over whether permissionless infrastructure should intervene when stolen assets pass through its systems. THORChain said it would not selectively block wallets or swaps. The network compared its role to censorship-resistant networks such as Bitcoin and Ethereum. GoPlus challenged that comparison. The security firm said THORChain's architecture gives node operators powers that base-layer validators do not have. GoPlus pointed to THORChain's threshold-signature vaults, where active nodes jointly authorize outbound transfers. The firm said releasing assets from those vaults requires an affirmative signing action. GoPlus also cited per-chain signing halts, network-wide pauses and Mimir governance as evidence that node operators can coordinate intervention. GoPlus said THORChain's network was halted during containment of its own $10.7 million exploit in May. The firm argued that the same emergency framework could be used against addresses linked to the Bitget attackers. THORChain disputed that conclusion. The network said a halt is intended to protect the protocol and differs from selectively censoring a user, wallet or swap. THORChain also said attacker addresses were not blacklisted during the May incident. The network said the protocol should remain neutral when known stolen funds move through it. GoPlus accused THORChain of benefiting financially from that position. The firm estimated that about 101.5 BTC worth roughly $8.5 million had exited through THORChain from the Bitget exploit. GoPlus said another 27.63 million XRP valued at about $43 million was being converted into Bitcoin. The firm also cited THORChain's role in laundering proceeds from the 2025 Bybit hack. GoPlus said the attacker moved hundreds of thousands of ETH through the protocol and generated millions of dollars in fees. The firm argued that fee income creates an incentive conflict when node operators decline to interfere with illicit flows. As Ethereum, USDT and other withdrawals reopen, investigators are trying to recover assets being broken up across chains and routed through infrastructure whose operators may refuse to stop them.