Bitget Resumes Bitcoin Withdrawals After $388M Breach; Hacker Swaps ETH via THORChain

By Khal · · 1 min read

Editorial illustration: Bitcoin coins sit on an extended tray inside an open, cracked vault reinforced with metal straps. Beside it, a red barrier separates an Ethereum symbol from another Bitcoin coin.
AI-generated editorial illustration · AI-generated editorial illustration · Published Sep 28, 2026, 11:33 a.m. (47 minutes ago)

In brief

  • Bitget restored Bitcoin withdrawals Monday after Sept. 24 breach compromised $388 million in assets
  • Ether withdrawals resume Tuesday; USDT follows Wednesday across multiple networks
  • Attacker converts stolen Ether to Bitcoin via THORChain, which lacks address blacklist functionality

Withdrawal Timeline and Scope

Bitget resumed Bitcoin withdrawals Monday following the security breach. ETH withdrawals are set to resume Tuesday across Ethereum, BNB Smart Chain, Arbitrum, Base and Optimism, followed by USDT on Wednesday across Ethereum, BNB Smart Chain, Solana and Tron. Withdrawals for other assets and peer-to-peer services return Friday.

Bitget CEO Gracy Chen explained that Bitcoin withdrawals came first because the withdrawal pipeline was completed first. The restoration applies to all users with no priority access for institutions, VIP customers or Bitget employees. It's a blanket approach—no favoritism in the recovery sequence.

The Breach and Asset Recovery

The Sept. 24 breach compromised part of Bitget's hot and warm wallet infrastructure, though cold wallets remained secure. The stolen amount was revised from $351.6 million to $387.5 million after accounting for additional transfers. The attacker has been active since the hack—Lookonchain reported that the attacker was swapping Ether for Bitcoin through THORChain.

THORChain's Response and Limitations

Chen called on THORChain to refuse services to addresses linked to the attack. But the protocol faces a structural constraint. THORChain said its network halt is an emergency security mechanism that affects the protocol broadly, not a selective freeze of specific funds. More importantly, the protocol has no built-in address blacklist, limiting its ability to block specific addresses.

This reveals a tension in decentralized cross-chain protocols. They're built to resist censorship and selective freezes—features that protect legitimate users but also complicate response to theft.

Related stories