Bitget Restores Bitcoin Withdrawals After Hacker Routes ETH via THORChain

Crypto exchange Bitget has restarted withdrawals after last week’s security incident that impacted nearly $388 million in assets. The exchange said it initially halted outflows while it verified which wallets and networks were affected, and confirmed that the attacker continues to move stolen crypto through THORChain.

Bitget resumed Bitcoin (BTC) withdrawals on Monday after suspending them in response to the breach. The exchange attributed the delay to restored withdrawals infrastructure and ongoing security checks, adding that more networks and asset types will come back over the next several days. Bitget also updated its estimate of stolen funds, revising the figure from $351.6 million to $387.5 million after accounting for additional transfers involving Zcash and Tron.

Key takeaways

• Bitget restarted BTC withdrawals first, citing that the withdrawal pipeline for Bitcoin was the earliest segment restored.
• Ether (ETH) withdrawals are scheduled to resume Tuesday, while Tether’s USDT is expected to follow on Wednesday for specified networks.
• The exchange said its cold wallets remained secure, while the breach affected part of its hot and warm wallet infrastructure.
• THORChain said its network halt is a broad emergency measure and not a targeted freeze of specific funds or a single swap.
• Bitget stated the withdrawal restoration schedule applies to all users, with no institutional or VIP priority access.

Bitget brings Bitcoin withdrawals back, with a phased restart

Bitget announced the first round of withdrawal resumption via a post on X, saying BTC withdrawals were restored Monday. In an ask-me-anything session, CEO Gracy Chen explained the sequencing: Bitcoin went first because the relevant withdrawal pipeline is completed earlier than other workflows.

Chen added that Ether (ETH) and USDT would be reinstated as security checks progress. Bitget’s published schedule confirms a phased approach across both networks and asset types.

According to Bitget’s announced plan, ETH withdrawals are set to resume Tuesday across Ethereum, BNB Smart Chain, Arbitrum, Base and Optimism. USDT withdrawals are scheduled for Wednesday across Ethereum, BNB Smart Chain, Solana and Tron. Bitget also said withdrawals for other assets and peer-to-peer services will return Friday.

The schedule, the exchange noted, applies to all users. Chen said there is no priority access for institutions, VIP customers, or Bitget employees.

How Bitget says the breach was contained

Bitget previously reported that the Sept. 24 breach compromised parts of its hot and warm wallet infrastructure, while its cold wallets were not affected. That distinction matters operationally: hot and warm wallets are typically used for liquidity and faster settlement, meaning any compromise there can increase the likelihood of immediate on-chain movement.

The exchange later revised the scope of impacted assets. It moved the stolen amount from $351.6 million to $387.5 million after incorporating additional transfers involving Zcash and Tron. The update suggests that early estimates were incomplete—potentially because attackers can continue moving funds across chains while an exchange is still reconciling internal wallet activity and tracing outgoing transfers.

Bitget’s earlier incident coverage also noted uncertainty surrounding affected assets and stressed the importance of verification, while this renewed withdrawal restart signals that internal checks have progressed enough for at least some assets and networks to be considered safe to use again.

Bitget urges THORChain to block attacker-linked activity

As Bitget restores withdrawals, the exchange’s CEO also criticized THORChain, urging it to refuse service to addresses associated with the attack. The argument was based on reports that the attacker swapped Ether for Bitcoin via THORChain and that ETH tied to the hack flowed into THORChain vaults.

Lookonchain reported the activity on Monday, and Arkham data presented in that reporting indicated attacker-linked ETH entering THORChain vaults. Bitget’s broader concern appears to be that decentralized liquidity mechanisms can keep providing a pathway for stolen funds to be converted and routed, potentially complicating recovery efforts.

However, THORChain pushed back on the request. In a Monday statement on X, THORChain said its network halt is an emergency security mechanism that affects the protocol broadly. It emphasized that the halt is not a selective freeze targeting specific funds or an individual swap.

Why THORChain’s halt may not be able to “pick winners”

THORChain’s response highlights a core constraint of many decentralized protocols: safety controls may be implemented at the network or protocol level rather than as address-specific blacklists.

Crypto author Anndy Lian argued that THORChain can halt trading, stop outbound transactions, or pause a connected chain, but that these measures generally affect users broadly. He also stated that the protocol has no built-in address blacklist, limiting its ability to block particular addresses without broader impact.

That tension—between exchange-led recovery goals and decentralized protocol design—matters to investors and users watching for how quickly stolen funds can be converted. A broad halt can reduce throughput and constrain further trading, but it may also be insufficient if attackers can still use other routes or if the protocol’s safety features cannot isolate specific counterparties.

For Bitget users, the operational takeaway is that withdrawal resumption and recovery are separate processes. Even as Bitget restores outflows on specific networks and assets, the attacker’s movement through third-party infrastructure can continue until broader conditions change.

Going forward, traders and depositors should watch Bitget’s next steps as ETH and USDT withdrawals are restored on their scheduled days, and monitor whether THORChain’s emergency measures remain in place or are adjusted. The lingering uncertainty is how quickly the attacker-linked activity can be slowed enough to reduce the risk of further dispersion of stolen funds while affected exchanges continue reconciliation.