Bitget exchange resumed Bitcoin withdrawals at 08:00 UTC on September 28 after a four-day freeze triggered by a $387.5 million security breach. The exchange’s chief executive said it had processed more than 9,500 withdrawal orders amounting to about 4,100 BTC by 17:00 UTC+8 that day. Ethereum withdrawals are slated to follow on September 29, USDT on September 30, and the remaining tokens, fiat and peer-to-peer services on October 2.

Withdrawal resumption and reserve impact

DeFiLlama’s exchange-wallet monitor indicated that Bitget’s tracked Bitcoin balance dropped from roughly 35,400 BTC to near 30,800 BTC, a decline of about 4,600 BTC. At prevailing prices this corresponds to roughly $390 million in Bitcoin leaving the exchange’s observable reserves. The decline exceeds the volume reported in processed customer withdrawals, suggesting additional wallet movements or differences in address coverage. Bitget’s reserves had hovered around 30,000 BTC before briefly climbing above 35,000 BTC and then slipping again.

Laundering chain and actor attribution

Blockchain investigator ZachXBT reported that Chinese illicit actors were laundering the proceeds on behalf of hackers allegedly linked to North Korea. The funds are being split across bridges, cross-chain bridges and privacy services, with transfers observed toward mixing platforms such as Wasabi. ZachXBT also noted similarities to activity seen after the $292 million Kelp DAO exploit earlier this year, linking the movement to a broader TraderTraitor campaign.

THORChain intervention debate

As the stolen assets travel through THORChain, the protocol faces pressure to act. THORChain maintains it will not selectively block wallets or swaps, arguing its function resembles censorship-resistant layers like Bitcoin and Ethereum. Security firm GoPlus counters that THORChain’s node operators can jointly authorize outbound transfers via threshold-signature vaults and can pause the network, as demonstrated after its own $10.7 million exploit in May. GoPlus estimates that about 101.5 BTC (≈ $8.5 million) and 27.63 million XRP (≈ $43 million) have already moved through THORChain from the Bitget haul, suggesting a potential fee-income incentive to avoid intervention.

Why it matters

The episode highlights how quickly large-scale exchange losses can fragment across multiple chains and services, complicating recovery efforts. It also raises questions about the responsibilities of permissionless infrastructure when illicit funds transit through their networks, a debate that could shape future governance and security practices in decentralized finance.