Bitget Reopens Bitcoin Withdrawals After the 388 Million USD Hack — ETH Comes Tuesday, USDT Wednesday

Bitget has switched the first lights back on. The exchange reopened Bitcoin withdrawals on Monday morning, four days after a security breach that ultimately cost it 387.5 million USD, giving users their first chance to move coins off the platform since the Sept. 24 incident threw the exchange into an emergency shutdown.

The restoration covers BTC on both the Bitcoin network and BNB Smart Chain, according to an announcement from the company. It is the opening move of a staged recovery plan that will run through the end of the week: Ether withdrawals are scheduled to resume Tuesday across Ethereum, BNB Smart Chain, Arbitrum, Base and Optimism, followed by USDT on Wednesday across Ethereum, BNB Smart Chain, Solana and TRON. Withdrawals for other assets and peer-to-peer services are set to return on Friday.

“We restored BTC first because the withdrawal pipeline is the first to be completed,” CEO Gracy Chen said during a Monday ask-me-anything session, adding that Ether and Tether withdrawals would follow as security checks progress. Chen also confirmed that the schedule applies to all users equally, with no priority lane for institutions, VIP customers or Bitget employees, an apparent attempt to defuse one of the most contentious questions of the past week: who gets their money out first when an exchange is wounded.

## What happened, in brief

The Sept. 24 breach compromised part of Bitget’s hot and warm wallet infrastructure, while its cold wallets remained secure, according to the exchange. Bitget initially put the damage at 351.6 million USD, then revised the figure upward to 387.5 million USD after accounting for additional transfers on Zcash and TRON that the first estimate had missed. The revision, announced days after the incident, was an uncomfortable admission that even a large exchange’s internal accounting can lag the attacker by tens of millions of dollars.

The company has since put a 5 percent bounty program on the table to help track the stolen funds and has pointed to VPN patterns associated with North Korean hacking groups as a preliminary lead, while stressing that attribution remains unconfirmed.

## The hacker is not waiting around

While Bitget rebuilds its withdrawal rails, the attacker has kept moving. On-chain analytics firm Lookonchain reported Monday that the attacker was swapping Ether for Bitcoin through THORChain, the cross-chain swap protocol, with Arkham data showing ETH linked to the attacker flowing into THORChain vaults. The choice is not accidental: THORChain has no built-in address blacklist, which makes it a natural exit corridor for funds that exchanges and issuers would rather see frozen.

That has set up an increasingly public standoff. Chen has publicly called on THORChain to refuse service to addresses linked to the attack, arguing the protocol bears some responsibility for the laundering route. THORChain’s answer, posted Monday, was blunt: the protocol’s network halt is an emergency security mechanism that affects the system broadly and “is not a selective freeze of specific funds or an individual swap.”

Crypto author Anndy Lian laid out the technical reality: THORChain can halt trading, stop outbound transactions or pause a connected chain entirely, but those measures hit every user at once. The protocol has no native tool for blacklisting a specific address, which limits what it can credibly promise an exchange demanding targeted intervention. The dispute has become a live stress test of a question the industry keeps refusing to settle, namely what “decentralization” obliges a protocol to do when a major counterparty asks for help.

## Why the order matters

The sequencing of the recovery tells its own story. Bitcoin first, then Ether, then USDT, then everything else reflects which withdrawal pipelines Bitget has been able to re-verify and re-secure fastest, and which assets users have been loudest about. BTC is also the asset the attacker is actively accumulating via THORChain swaps, an irony not lost on observers watching stolen ETH convert into the very asset Bitget just re-enabled.

For users, the week ahead is effectively a queue with published timestamps. ETH holders get access Tuesday, USDT holders Wednesday, and holders of longer-tail assets along with peer-to-peer traders must wait until Friday. Anyone who does not need to move funds immediately may reasonably wait for the first wave of withdrawals to clear without incident before testing the restored rails themselves.

Market context is subdued. At the time of writing, Bitcoin trades near 83,073 USD, down roughly 2 percent on the day, Ethereum sits at 2,668 USD and Solana at 118 USD, according to CoinGecko data, so the reopening is happening into a soft tape rather than a panicked one.

Whether Bitget’s staged reopening holds to schedule is now the operative question. The exchange has committed to dates in public, in writing, and with its CEO on record. Each checkpoint it hits buys back a measure of the credibility the breach cost it; each slip will be measured against a community that spent the last four days counting every wallet movement on-chain. Friday, when the last tranche of withdrawals is due back, is the real finish line.