Bitget Restarts Bitcoin Withdrawals After THORChain ETH Swap

Bitget Resumes Withdrawals After $388 Million Hack

Cryptocurrency exchange Bitget is gradually restoring withdrawal services following a significant security breach that saw nearly $388 million in assets compromised. The attacker continues to move the stolen funds through the THORChain protocol.

Bitget announced on Monday that it had resumed Bitcoin (BTC) withdrawals, a day after suspending all outgoing transactions due to the security incident. The exchange indicated that withdrawals for additional assets and across various networks would be reinstated in the coming days.

The breach, which occurred on September 24, affected a portion of Bitget’s hot and warm wallet infrastructure, while the exchange confirmed that its cold wallets remained secure. The initial estimated loss of $351.6 million was later revised to $387.5 million after accounting for further transfers involving Zcash and Tron.

Bitget CEO Gracy Chen stated during a question-and-answer session on Monday that Bitcoin withdrawals were prioritized due to the completion of the necessary withdrawal pipeline. She added that Ether (ETH) and Tether’s USDt (USDT) withdrawals would follow as security checks progressed.

Phased Withdrawal Restoration

According to Bitget’s published schedule, Ether withdrawals are slated to resume on Tuesday across the Ethereum, BNB Smart Chain, Arbitrum, Base, and Optimism networks. This will be followed by USDt withdrawals on Wednesday, available on Ethereum, BNB Smart Chain, Solana, and Tron. Withdrawals for other digital assets and peer-to-peer services are expected to be fully restored by Friday.

Chen clarified that this schedule applies uniformly to all users, with no preferential treatment for institutional clients, VIP customers, or Bitget employees.

Call for Action on THORChain

Bitget CEO Gracy Chen has urged THORChain, a decentralized protocol facilitating cross-chain asset swaps, to deny services to wallet addresses associated with the hack.

On Monday, blockchain analytics firm Lookonchain reported that the attacker was exchanging Ether for Bitcoin via THORChain. Data from Arkham also indicated that ETH linked to the attacker was being channeled into THORChain’s vaults.

THORChain responded on Monday, explaining that its network halt was an emergency security measure impacting the protocol broadly, and not a targeted freeze of specific funds or transactions.

Crypto author Anndy Lian noted that while THORChain possesses capabilities to halt trading, stop outbound transactions, or pause connected blockchains, these actions have widespread implications for all users. He pointed out that the protocol lacks a built-in address blacklist, limiting its ability to block specific wallets.