Exchange resumes withdrawals, but stolen funds flow through bridges and mixers
Bitget resumed Bitcoin withdrawals on September 28 after a four-day freeze following a $387.5 million hack, during which nearly 5,000 BTC exited the exchange’s tracked reserves. The cryptocurrency exchange processed 9,585 withdrawal orders totaling 4,098.036 BTC as of 17:00 UTC+8 that day, according to CEO Gracy Chen.
The hack marked the largest security incident in Bitget’s eight-year operational history. Attackers obtained internal credentials by exploiting vulnerabilities in third-party products, then used those credentials to submit fraudulent withdrawal instructions that bypassed risk controls. “Attackers exploited vulnerabilities in third-party products to obtain internal credentials,” Chen said in a statement.
Bitget’s tracked Bitcoin balance declined by 4,642 BTC, falling from 35,412 BTC to 30,770 BTC, representing approximately $391 million in value at prevailing prices. The exchange stated the attack did not compromise private keys or cold-wallet reserves. Bitget isolated affected systems, revoked and reissued credentials, and restructured access to sensitive infrastructure. The vendor responsible for the vulnerable third-party product is working on a fix while Bitget has disabled the affected functionality.
Investigators traced stolen assets across multiple laundering channels. Blockchain investigator ZachXBT identified Chinese illicit actors converting proceeds on behalf of hackers with alleged ties to North Korea. Stolen funds are being fragmented through cross-chain bridges, protocols, and privacy services including Wasabi. An estimated 101.5 BTC, valued at $8.5 million, exited through THORChain, while 27.63 million XRP worth $43 million is being converted to Bitcoin via the same protocol.
ZachXBT linked one participant in the laundering network to movements following the $292 million Kelp DAO exploit, suggesting overlapping criminal infrastructure.
Bitget announced a staggered withdrawal resumption schedule. Ethereum withdrawals are scheduled for September 29, USDT withdrawals for September 30, and remaining tokens, fiat, and peer-to-peer services for October 2. The exchange committed to replenishing its Protection Fund with $300 million within one week and stated that “customers will bear no losses from the incident and that its Protection Fund will cover the shortfall,” Chen said.
THORChain’s neutrality stance amid protocol debate
THORChain declined to intervene in the flow of stolen funds through its cross-chain protocol, arguing its role is comparable to censorship-resistant networks like Bitcoin and Ethereum. The protocol operates as a neutral transaction layer without selective user controls.
Security firm GoPlus countered that THORChain’s threshold-signature vaults and node operator coordination powers provide emergency controls comparable to those deployed during THORChain’s own May exploit, valued at $10.7 million. GoPlus argued that refusing to use these controls creates a financial incentive conflict through fee income generated by processing stolen assets. THORChain disputed the comparison, maintaining that a network halt for protocol protection differs fundamentally from selectively censoring specific users or wallets.
