Crypto exchange Bitget resumed Bitcoin withdrawals on Monday after a Sept. 24 hot-wallet breach that drained $387.5 million in assets, while blockchain analytics show the attacker continues laundering funds through the cross-chain protocol THORChain.

The resumption came days after the incident, with Ether, Tether's USDt and other tokens scheduled to come back online in phases through Friday.

How much was actually stolen?

The Sept. 24 attack compromised part of Bitget's hot and warm wallet infrastructure while its cold wallets stayed secure, the exchange said. Bitget initially disclosed losses of $351.6 million but revised the figure upward to $387.5 million after accounting for additional transfers that flowed through Zcash and Tron, two networks whose transaction graphs are harder to trace than Ethereum's.

What is Bitget restoring first?

Bitcoin withdrawals on the Bitcoin network and BNB Smart Chain resumed first, CEO Gracy Chen said during a Monday ask-me-anything session. "We restored BTC first because the withdrawal pipeline is the first to be completed," Chen said, framing the staged approach as a function of completed security reviews rather than tiered user access.

The schedule applies uniformly. "No priority access for institutions, VIP customers or Bitget employees," Chen said, addressing concerns that large clients might regain functionality ahead of retail users.

What is the timeline for the remaining assets?

• Ether (ETH) — Tuesday, across Ethereum, BNB Smart Chain, Arbitrum, Base and Optimism
• Tether (USDT) — Wednesday, across Ethereum, BNB Smart Chain, Solana and Tron
• Other tokens and peer-to-peer trading — Friday

How is the attacker moving the stolen funds?

On-chain firm Lookonchain reported Monday that the attacker was swapping ETH for BTC through THORChain. Arkham Intelligence data confirmed Ether tied to the exploit flowing into THORChain vaults and being converted into native BTC for further displacement across networks.

Can THORChain freeze the funds?

THORChain pushed back Monday against Chen's call for address-specific blocking. The protocol said its network-halt function is an emergency mechanism that "is not a selective freeze of specific funds or an individual swap," and that activating it affects all users globally.

Crypto author Anndy Lian expanded on the technical constraint: THORChain can halt trading, stop outbound transactions or pause a connected chain, but those levers hit every participant. The protocol carries no built-in address blacklist, limiting any wallet-level enforcement to off-chain coordination alone.

The standoff illustrates a recurring structural problem in decentralized finance. Swap protocols depend on permissionless execution to attract liquidity, yet that openness makes them attractive to exploiters and frustrating for institutional victims with little on-chain recourse.

What happens next?

With peer-to-peer services due Friday, Bitget's full trading footprint is set to return within six days of Monday's announcement. The unresolved question is whether THORChain's governance will reconsider its no-blacklist posture under pressure from one of the largest exchange counterparties it serves.