Bitget Restarts Bitcoin Withdrawals After Hacker Uses THORChain

Crypto exchange Bitget has begun restoring customer withdrawals after a security breach last week exposed parts of its hot and warm wallet infrastructure. The incident impacted assets totaling about $388 million, and Bitget said the attacker has continued moving stolen funds through THORChain.

Bitget suspended withdrawals following the breach, then announced on Monday that it is resuming them in stages. According to the exchange, BTC withdrawals restarted first, with Ether (ETH) and Tether’s USDt (USDT) scheduled to follow as security checks progress.

Key takeaways

• Bitget resumed Bitcoin (BTC) withdrawals Monday after suspending withdrawals following a breach reported in connection with assets later estimated at roughly $388 million.
• Bitget says the compromise involved portions of its hot and warm wallet setup, while cold wallets remained secure.
• ETH and USDT withdrawal resumption is planned for Tuesday and Wednesday respectively, with additional assets and peer-to-peer withdrawals returning later in the week.
• Bitget’s CEO urged THORChain to refuse services to attacker-linked addresses, but THORChain says its network halt is broad and cannot selectively freeze individual funds.

BTC withdrawals restart as Bitget rolls out staged recovery

Bitget said it restored BTC withdrawals on Monday. In remarks shared during an ask-me-anything session, CEO Gracy Chen explained that BTC was prioritized because the “withdrawal pipeline is the first to be completed.” She also indicated that the exchange would expand withdrawals to other assets once its security review for each step is finished.

Chen further stated that Ether (ETH) and USDT would resume after ongoing security checks. Bitget’s schedule, published in an exchange support notice, outlines when users can expect withdrawals to return across multiple networks.

Under Bitget’s announced timetable, ETH withdrawals are set to restart Tuesday across Ethereum, BNB Smart Chain, Arbitrum, Base, and Optimism. USDT withdrawals are scheduled for Wednesday across Ethereum, BNB Smart Chain, Solana, and Tron. Withdrawals for other assets and peer-to-peer services are slated to return on Friday, with the plan applying to all users.

Bitget also emphasized that the schedule is uniform, with no priority access for institutions, VIP customers, or Bitget employees.

Breach impact revised upward after accounting for additional transfers

The breach occurred on Sept. 24, according to Bitget’s description of what was affected. The exchange said part of its hot and warm wallet infrastructure was compromised, while its cold wallets were not.

Bitget later updated the scope of the stolen amount. The figure was revised from $351.6 million to $387.5 million after the exchange accounted for additional transfers involving Zcash and Tron. The change underscores how incident accounting can evolve as exchanges reconstruct on-chain movement and reconcile internal wallet activity.

THORChain disputes calls for selective freezing

Beyond Bitget’s internal response, the incident has drawn attention to how attackers can continue to convert stolen assets on decentralized venues. Bitget’s CEO said THORChain should refuse services to addresses connected to the exploit.

That request came amid claims that the attacker was swapping Ether for Bitcoin through THORChain. According to monitoring posts referenced from Lookonchain, data reportedly indicated ETH linked to the attacker flowing into THORChain vaults. Arkham data was also cited as showing the attacker-associated ETH entering THORChain infrastructure.

THORChain responded to the situation by describing its actions as an emergency security response that halts the network broadly. In its statement, THORChain said the mechanism “is not a selective freeze of specific funds or an individual swap,” characterizing the halt as affecting the protocol generally rather than targeting particular addresses.

A separate perspective from crypto author Anndy Lian argued that while THORChain can halt trading, stop outbound transactions, or pause a connected chain, it does not include an on-chain blacklist feature that would enable the protocol to block specific addresses. That limitation helps explain why a “selective freeze” request may not be technically aligned with how THORChain’s emergency controls are designed to operate.

What investors and users should watch next

Bitget’s staged withdrawal resumption will be the immediate signal to users, but the next key variable is whether the attacker’s activity through decentralized routes slows as network-wide measures remain in place. Readers should monitor Bitget’s subsequent withdrawal checkpoints for ETH, USDT, and other assets, and watch whether any further protocol-level actions by THORChain or other counterparties emerge as the incident evolves.