Bitget Resumes Withdrawals as Hacker Begins Moving $388 Million in Stolen Crypto

Bitget has resumed Bitcoin withdrawals following a $388 million security breach on September 24, with Ether withdrawals scheduled to return Tuesday and USDt withdrawals on Wednesday as the exchange works to fully restore services. The hack is among the largest in crypto exchange history, and investigators including on-chain sleuth ZachXBT are actively seeking help tracing the stolen assets, which are being moved across multiple blockchains.

The hacker made their first on-chain transaction moves on September 28, with the wallet linked to the breach swapping Ether through THORChain, a cross-chain protocol that does not require identity verification and makes tracing significantly harder. More than $83 million worth of XRP was also moved, raising pointed questions about why those funds could not be frozen in the same way Tether can freeze USDT on its own platform.

ZachXBT reported that suspected North Korea-linked launderers are soliciting fund-transfer assistance on Discord and Telegram as the stolen assets move across chains, adding a geopolitical dimension to what is already a major exchange security incident. The decentralized nature of both XRP Ledger and THORChain means no single entity can halt or reverse transactions once funds leave custodial wallets, in contrast to centralized stablecoin issuers like Tether.

Meanwhile, Bitcoin pulled back roughly 2% to around $83,000 on September 28, with macro uncertainty weighing on risk assets despite a strong prior week. Bitcoin had closed the previous week at $84,445, its highest weekly close in eight months and a second consecutive close above the Weekly 50-period moving average, supported by an ISM reading of 55.6, a four-year high, cooling core inflation, and the Russell 2000 reaching a new all-time high.