Bitget restarted Bitcoin withdrawals on Monday, Sept. 28, 2026, the first step in restoring services after a Sept. 24 breach that the exchange now values at $387.5 million, Cointelegraph reported.
CEO Gracy Chen said during a Monday ask-me-anything session that BTC moved first because its withdrawal pipeline was the first to be completed, and that asset balances and account data remain accurate. The exchange had suspended customer withdrawals after detecting unauthorized transfers from part of its hot and warm wallet infrastructure; cold wallets were not compromised.
Also read: Bitget Confirms $351.6M Breach, Withdrawals Frozen
Key facts
- Bitget revised the stolen amount to $387.5 million from an earlier figure of $351.6 million after accounting for additional transfers on Zcash and Tron.
- BTC withdrawals reopened on the Bitcoin network and BNB Smart Chain on Monday; Ether was set for Tuesday across Ethereum, BNB Smart Chain, Arbitrum, Base and Optimism, followed by USDT on Wednesday across Ethereum, BNB Smart Chain, Solana and Tron, with other assets and peer-to-peer services on Friday.
- Chen said the schedule applies to all users, with no priority access for institutions, VIP customers or Bitget employees.
- Blockchain security firms TRM Labs and SlowMist’s MistTrack tracked the stolen funds moving across networks, according to Coinpedia.
- Coinpedia reported that the attacker has moved roughly $4 million to $4.5 million of the stolen $387.5 million through THORChain and converted it into Bitcoin.
The THORChain dispute
Chen publicly asked THORChain validators to refuse service to addresses tied to the attackers, arguing that decentralization is a design principle rather than a shield for known stolen funds. THORChain declined, describing itself as a decentralized, permissionless network similar in design to Bitcoin and Ethereum, and said its network halt is an emergency security mechanism affecting the protocol broadly rather than a selective freeze of particular funds or an individual swap.
Crypto author Anndy Lian said THORChain can halt trading, stop outbound transactions or pause a connected chain, but those measures hit users broadly; the protocol has no built-in address blacklist, which limits its ability to block specific addresses, Cointelegraph reported. Critics including SlowMist founder Cosine argued the network could do more, pointing to past incidents when THORChain developers used a “red button” to pause the network during an exploit.
Also read: Bitget Hack: $157M in Stolen XRP Cannot Be Frozen
Stablecoin freezes and an earlier estimate
Coverage elsewhere frames the case around stablecoin issuers as well. Crypto.news cited security researcher Taylor Monahan, who flagged transfers and swaps tied to the attacker and questioned why the funds stayed movable despite Circle’s ability to block transfers from specific USDC addresses. Circle has said it exercises its freeze ability when legally compelled by an appropriate authority, and its terms reserve the right to block addresses it determines may be linked to illegal activity.
Coinpedia reported that the hackers first swapped stolen USDT and USDC into ETH and BNB to avoid freezes by issuers such as Tether and Circle, but that the two issuers still froze 218,023 USDT and 99,990 USDC worth about $318,000 combined from an attacker-linked address. On-chain tracker Lookonchain put the stolen portfolio at roughly $356.8 million using prices at the time of its update, a different measurement from Bitget’s internal loss figure, Crypto.news noted.
In an April statement after the Drift Protocol hack, Circle called for clearer rules and faster coordinated action, and on-chain investigator ZachXBT alleged the issuer had taken minimal action or failed to act quickly enough in 15 cases involving more than $420 million in suspected illicit USDC flows since 2022. A claimant separately sued Circle in a federal district court in Massachusetts over transfers after the Drift exploit, alleging it failed to stop roughly $230 million in stolen USDC routed through its Cross-Chain Transfer Protocol; those are allegations, not a court finding.
Why it matters
The sequence shows how quickly a centralized exchange can restore partial service after a large breach, while the funds themselves keep moving through infrastructure its operator cannot unilaterally control. For Bitget users, access to BTC on two networks returned first, with other assets following on a published timetable that does not favour large clients. For the wider market, the standoff over THORChain’s role puts a spotlight on whether permissionless cross-chain swaps should carry any responsibility when identifiable stolen assets pass through them, and it tests the practical limits of stablecoin freezing once assets have been converted.
What to watch
The next checkpoints are Bitget’s announced withdrawal schedule for Ether, USDT and other assets, and whether the attacker continues moving funds through THORChain; Coinpedia noted the converted BTC has been spread across thousands of private wallets, making recovery harder. Any legal order or enforcement action touching Circle, THORChain or the flagged addresses would shift the dispute’s terms.
This article is not financial advice. Crypto markets are volatile and uncertain, and readers should do their own research.
Reported by cointelegraph.com.
Sources: Cointelegraph, Crypto.news, Coinpedia
