Nearly 5,000 Bitcoin Leave Bitget as Hack Proceeds Scatter Across Chains
•
September 28, 2026 7:14 pm
•
Comments
Bitget’s reopening is giving the market its first hard look at customer behavior after the exchange’s $387.5 million security breach—and the initial movement is substantial.
Bitget CEO Gracy Chen said the exchange had processed 9,585 Bitcoin withdrawal orders totaling 4,098.036 BTC by 5 p.m. in Singapore on Monday. Separate wallet data showed an even larger decline in the exchange’s tracked Bitcoin balance.
According to CryptoSlate, DeFiLlama tracked about 30,770 BTC after the reopening, down from roughly 35,412 BTC. That difference—about 4,642 BTC—was worth approximately $391 million at prevailing prices.
The two figures should not be treated as identical. Exchange-wallet trackers can pick up internal movements and changes in address coverage as well as customer withdrawals, but the speed of the decline still shows how closely users are testing access after a four-day freeze.
Bitget said Bitcoin withdrawals resumed at 08:00 UTC on September 28 after added security work. Ethereum withdrawals were scheduled for September 29, USDT for September 30, and the remaining token, fiat, and peer-to-peer services for October 2.
Bitget has begun the phased resumption of withdrawals following the security incident identified on September 24, with BTC withdrawals on the Bitcoin network started at 08:00 UTC on September 28 as scheduled.
The resumption follows additional security work across Bitget's…
— Bitget (@bitget) September 28, 2026
The exchange says attackers exploited vulnerabilities in third-party products, obtained internal credentials, and used them to submit fraudulent withdrawal instructions. Bitget says private keys and cold-wallet reserves were not compromised, affected systems were isolated, and internal credentials were revoked and reissued.
Bitget has also said customers will not absorb the loss. Its Protection Fund is expected to cover the shortfall, with company capital used to rebuild the fund above $300 million within a week.
The harder problem is following the stolen assets as they break into smaller pieces and cross networks. Lookonchain reported that stolen Ether was being exchanged for Bitcoin through THORChain, one of several routes investigators are watching.
The #Bitget hacker, who stole $351.6M, is now swapping $ETH for $BTC through #THORChain.https://t.co/JaQJzTXSbahttps://t.co/Nr3GUCGouf pic.twitter.com/bKLixz874C
— Lookonchain (@lookonchain) September 28, 2026
That movement has reopened a difficult argument around neutral infrastructure. THORChain says it should not selectively block wallets or swaps, while security researchers argue that its emergency controls give node operators more practical choices than base-layer validators.
For users, the immediate test is simpler: whether withdrawals continue reopening on schedule and whether Bitget can keep the exchange stable while investigators chase funds that are already spreading across chains.
Join the conversation!
We have no tolerance for comments containing violence, racism, profanity, vulgarity, doxing, or discourteous behavior. If a comment is spam, instead of replying to it please click the icon below and to the right of that comment. Thank you for partnering with us to maintain fruitful conversation.