Bitget's tracked Bitcoin balance fell by roughly 4,642 BTC — about $391 million at prevailing prices — in the hours after the exchange reopened withdrawals following its $387.5 million hack, according to DeFiLlama data cited Sept. 28.

The exchange's Bitcoin balance dropped to about 30,770 BTC from 35,412 BTC, even as CEO Gracy Chen said Bitget had processed only 9,585 withdrawal orders totaling 4,098.036 BTC as of 17:00 UTC+8. The gap of more than 500 BTC points to wallet movements or address-coverage differences tracked by DeFiLlama rather than customer withdrawals alone.

What does the restart tell us about user response?

Bitget restored Bitcoin withdrawals at 08:00 UTC on Sept. 28 after a four-day freeze, the longest in the exchange's eight-year history. Ethereum withdrawals are scheduled for Sept. 29, USDT on Sept. 30, and remaining tokens, fiat, and peer-to-peer services on Oct. 2.

The pace of the Bitcoin outflow provides the first concrete signal of how customers are responding to the incident. Chen said the company plans to replenish its Protection Fund with internal capital to more than $300 million within a week, a move intended to back the exchange's pledge that users will bear no losses.

How did the attackers breach Bitget?

Chen said a completed internal trace found the attackers exploited vulnerabilities in third-party products to obtain internal credentials. Those credentials then enabled fraudulent withdrawal instructions that bypassed Bitget's risk controls.

"We have isolated affected systems, revoked and reissued internal credentials, and restructured access to sensitive infrastructure," Chen wrote on X. The exchange has disabled the affected third-party functionality pending a vendor fix.

Mandiant and SlowMist continue to assist with forensic analysis. Bitget previously described the incident as a compromise of a critical backend system in its wallet infrastructure, now remediated before withdrawals resumed.

Where is the stolen Bitcoin going?

Blockchain investigator ZachXBT said Chinese illicit actors are laundering the proceeds on behalf of hackers he described as "allegedly linked to North Korea." He documented chain-hopping and deposits into Wasabi, a CoinJoin-based mixing service.

ZachXBT also linked one participant in the laundering network to wallet behavior seen after the $292 million Kelp DAO exploit earlier this year and to several attacks attributed to the TraderTraitor campaign.

Can THORChain stop the flows?

The laundering trail has put THORChain at the center of a dispute over whether permissionless infrastructure should intervene when stolen assets pass through. The cross-chain protocol says it will not selectively block wallets or swaps, arguing its role is comparable to censorship-resistant networks.

Blockchain security firm GoPlus challenged that framing. It pointed to THORChain's threshold-signature vaults, per-chain signing halts, and Mimir governance as evidence that node operators can coordinate intervention when they choose.

GoPlus estimated that about 101.5 BTC, worth roughly $8.5 million, has already exited through THORChain from the Bitget exploit, while another 27.63 million XRP, valued at about $43 million, is being converted into Bitcoin on the protocol. The firm accused THORChain of benefiting financially from the flow, citing its role in laundering proceeds from the 2025 Bybit hack.

THORChain disputes the characterization. It notes that a network halt during its own $10.7 million exploit in May was meant to protect the protocol itself, not to selectively censor a user. "Attacker addresses were not blacklisted during the May incident," the protocol said, maintaining that the system should remain neutral even when known stolen funds move through it.

What comes next for Bitget and the industry?

The exchange faces a tight operational calendar. Ethereum withdrawals reopen Sept. 29 and USDT on Sept. 30, with full service restoration targeted for Oct. 2. Each reopening is a stress test of internal controls rewritten in the past week.

The broader question for the industry is whether decentralized protocols that retain emergency controls should remain transaction-neutral when those same systems are used to launder funds from major hacks. Bitget's case is unlikely to resolve that debate, but the protocol operators' decisions over the next 48 hours will shape how regulators and law enforcement frame the answer.