The cryptocurrency market remains highly volatile. This article is for informational purposes only and does not constitute financial advice.
Bitget Reopens Bitcoin Withdrawals After the 388 Million USD Hack — ETH Comes Tuesday, USDT Wednesday
Bitget has switched the first lights back on. The exchange reopened Bitcoin withdrawals on Monday morning, four days after a security breach that ultimately cost it 387.5 million USD, giving users their first chance to move coins off the platform since the Sept. 24 incident threw the exchange into an emergency shutdown.
The restoration covers BTC on both the Bitcoin network and BNB Smart Chain, according to an announcement from the company. It is the opening move of a staged recovery plan that will run through the end of the week: Ether withdrawals are scheduled to resume Tuesday across Ethereum, BNB Smart Chain, Arbitrum, Base and Optimism, followed by USDT on Wednesday across Ethereum, BNB Smart Chain, Solana and TRON. Withdrawals for other assets and peer-to-peer services are set to return on Friday.
“We restored BTC first because the withdrawal pipeline is the first to be completed,” CEO Gracy Chen said during a Monday ask-me-anything session, adding that Ether and Tether withdrawals would follow as security checks progress. Chen also confirmed that the schedule applies to all users equally, with no priority lane for institutions, VIP customers or Bitget employees, an apparent attempt to defuse one of the most contentious questions of the past week: who gets their money out first when an exchange is wounded.
## What happened, in brief
The Sept. 24 breach compromised part of Bitget’s hot and warm wallet infrastructure, while its cold wallets remained secure, according to the exchange. Bitget initially put the damage at 351.6 million USD, then revised the figure upward to 387.5 million USD after accounting for additional transfers on Zcash and TRON that the first estimate had missed. The revision, announced days after the incident, was an uncomfortable admission that even a large exchange’s internal accounting can lag the attacker by tens of millions of dollars.
The company has since put a 5 percent bounty program on the table to help track the stolen funds and has pointed to VPN patterns associated with North Korean hacking groups as a preliminary lead, while stressing that attribution remains unconfirmed.
## The hacker is not waiting around
While Bitget rebuilds its withdrawal rails, the attacker has kept moving. On-chain analytics firm Lookonchain reported Monday that the attacker was swapping Ether for Bitcoin through THORChain, the cross-chain swap protocol, with Arkham data showing ETH linked to the attacker flowing into THORChain vaults. The choice is not accidental: THORChain has no built-in address blacklist, which makes it a natural exit corridor for funds that exchanges and issuers would rather see frozen.
That has set up an increasingly public standoff. Chen has publicly called on THORChain to refuse service to addresses linked to the attack, arguing the protocol bears some responsibility for the laundering route. THORChain’s answer, posted Monday, was blunt: the protocol’s network halt is an emergency security mechanism that affects the system broadly and “is not a selective freeze of specific funds or an individual swap.”
Crypto author Anndy Lian laid out the technical reality: THORChain can halt trading, stop outbound transactions or pause a connected chain entirely, but those measures hit every user at once. The protocol has no native tool for blacklisting a specific address, which limits what it can credibly promise an exchange demanding targeted intervention. The dispute has become a live stress test of a question the industry keeps refusing to settle, namely what “decentralization” obliges a protocol to do when a major counterparty asks for help.
## Why the order matters
The sequencing of the recovery tells its own story. Bitcoin first, then Ether, then USDT, then everything else reflects which withdrawal pipelines Bitget has been able to re-verify and re-secure fastest, and which assets users have been loudest about. BTC is also the asset the attacker is actively accumulating via THORChain swaps, an irony not lost on observers watching stolen ETH convert into the very asset Bitget just re-enabled.
For users, the week ahead is effectively a queue with published timestamps. ETH holders get access Tuesday, USDT holders Wednesday, and holders of longer-tail assets along with peer-to-peer traders must wait until Friday. Anyone who does not need to move funds immediately may reasonably wait for the first wave of withdrawals to clear without incident before testing the restored rails themselves.
Market context is subdued. At the time of writing, Bitcoin trades near 83,073 USD, down roughly 2 percent on the day, Ethereum sits at 2,668 USD and Solana at 118 USD, according to CoinGecko data, so the reopening is happening into a soft tape rather than a panicked one.
Whether Bitget’s staged reopening holds to schedule is now the operative question. The exchange has committed to dates in public, in writing, and with its CEO on record. Each checkpoint it hits buys back a measure of the credibility the breach cost it; each slip will be measured against a community that spent the last four days counting every wallet movement on-chain. Friday, when the last tranche of withdrawals is due back, is the real finish line.
four days to get BTC withdrawals back after a 388m hack. honestly faster than i expected
ill believe it when my USDT actually moves wednesday. friday for everything else feels optimistic
same. BTC pipes reopening first is smart PR but my stack is ETH on base, tuesday genuinely cannot come soon enough
tuesday is the one to watch. if ETH clears on arbitrum and base without fees spiking ill relax, USDT on wednesday is just volume
if base and arbitrum fees stay flat while bitget ETH drains all tuesday, thats the cleanest reserves match liabilities proof anyone will ever get
friday full restore is only 48h after wednesday too, thats aggressive. if eth clears clean tuesday they might actually pull it off
wednesday usdt across four chains including tron is the real stress test. tron rails under load are their own adventure
tron inclusion is the detail most people skipped. huge chunk of the USDT float lives on those rails, if withdrawals clear there wednesday ill be genuinely impressed
4 days to reopen BTC withdrawals after a 387.5M dollar hack is honestly faster than i expected. still moving my stack off the moment ETH opens tuesday
same plan as rektrefugee lol, just hope the ETH queues on arbitrum and base dont choke when everyone hits withdraw at the same time
if ETH queues do choke on tuesday its gonna be a slow motion bank run rerun. gracy chen better have rate limits ready this time
splitting eth across arbitrum, base and optimism is exactly why tuesday can work. L2 rails absorb a withdrawal stampede way better than mainnet, smart staging
same, but props for doing BTC first instead of a staggered per-asset drip. the tuesday ETH test across five chains is the real stress event
restoring BTC on both the main chain and BNB Smart Chain first was the right call, that covers most of the volume trying to leave
No priority lane for VIPs is a smart move by Gracy Chen. Last thing they need now is stories about whales jumping the queue.
I closed my Bitget account back in 2023. Fees were fine but one hack is all it takes with these mid-tier exchanges.
gracy chen saying no priority lane for anyone is the right message. now lets see if the withdrawal logs actually back that up this week
logs or it didnt happen. if the first withdrawals tuesday are all nine figure accounts the message dies instantly
they promised withdrawal logs last time too and we got a blog post. publish the queue timestamps, its one csv
publishing queue timestamps as a csv would cost them nothing and settle the priority lane question in an hour. wednesday usdt on tron is the real verdict tho
four days from a 387.5m hole to BTC withdrawals moving again is genuinely fast. mt gox took the better part of a decade, different era entirely
388m gone and they are still honoring balances 1:1, honestly didnt expect that. wouldnt have shocked me to see some kind of haircut like ftx did
the 1:1 balances thing surprised me too. though id feel a lot better if an independent party actually verified the reserves instead of us taking an ama at face value
BTC back in four days is one thing, the friday p2p reopening is the part nobody watches. thats where the real exit volume hides
gracy chen doing a live ama in week one of recovery instead of going dark is worth something. most exchange bosses vanish after a 387.5m hole