Bitget Restores Bitcoin Withdrawals as $351.6 Million Hacker Routes Ether Through THORChain

Bitget has reopened Bitcoin withdrawals, but the exchange is doing so while investigators continue following stolen crypto across chains.

The timing matters. Customers can move BTC again, yet the attacker has not stopped moving.

That makes this less of an all-clear than the first visible step in a much longer recovery.

Cointelegraph reported that Bitget restored Bitcoin-network withdrawals at 08:00 UTC on September 28 after a security breach valued at nearly $388 million. The exchange is bringing services back in phases rather than flipping every withdrawal rail on at once.

Bitget confirmed the restart directly and said it followed additional security work across its systems:

Bitget has begun the phased resumption of withdrawals following the security incident identified on September 24, with BTC withdrawals on the Bitcoin network started at 08:00 UTC on September 28 as scheduled.

The resumption follows additional security work across Bitget's…

— Bitget (@bitget) September 28, 2026

Restoring BTC first is sensible. Bitcoin is the largest crypto asset by market value, and a working Bitcoin withdrawal rail is an important confidence test for any major exchange coming out of a hot-wallet incident.

But the other side of the story is still moving fast. Onchain trackers say the attacker is converting Ether into Bitcoin through THORChain, a decentralized cross-chain liquidity protocol. That route makes the response more complicated because there is no central operator who can simply reverse a swap.

Lookonchain put the tracked theft at $351.6 million and published the active cross-chain movement:

The #Bitget hacker, who stole $351.6M, is now swapping $ETH for $BTC through #THORChain.https://t.co/JaQJzTXSbahttps://t.co/Nr3GUCGouf pic.twitter.com/bKLixz874C

— Lookonchain (@lookonchain) September 28, 2026

The difference between the public estimates is a reminder that early hack accounting is rarely clean. Some totals describe the original loss, while others cover the amount tied to specific addresses or assets that remain visible onchain.

For Bitget users, the practical question is not whether one withdrawal network is back. It is whether the exchange can restore the remaining services without another interruption, honor customer balances and publish enough evidence for users to judge the recovery.

The Bitcoin restart is progress. The hacker’s continued swaps show why it is not closure.

Join the conversation!

We have no tolerance for comments containing violence, racism, profanity, vulgarity, doxing, or discourteous behavior. If a comment is spam, instead of replying to it please click the icon below and to the right of that comment. Thank you for partnering with us to maintain fruitful conversation.