{"id":13834,"date":"2026-09-28T22:58:37","date_gmt":"2026-09-28T22:58:37","guid":{"rendered":"https:\/\/cryptonews.uk.com\/?p=13834"},"modified":"2026-09-28T22:58:37","modified_gmt":"2026-09-28T22:58:37","slug":"nearly-5000-btc-leaves-bitget-as-hackers-begin-laundering-387-million-haul","status":"publish","type":"post","link":"https:\/\/cryptonews.uk.com\/?p=13834","title":{"rendered":"Nearly 5,000 BTC leaves Bitget as hackers begin laundering $387 million haul"},"content":{"rendered":"

<\/p>\n

\n

Nearly 5,000 Bitcoin has left Bitget\u2019s tracked reserves after the crypto exchange reopened withdrawals following its $387.5 million hack.<\/p>\n

On Sept. 28, Bitget Chief Executive Officer Gracy Chen said the exchange had processed 9,585 withdrawal orders totaling 4,098.036 BTC as of 17:00 UTC+8, shortly after it resumed Bitcoin withdrawals.<\/p>\n

Separate DeFiLlama data showed Bitget\u2019s tracked Bitcoin balance falling to about 30,770 BTC from 35,412 BTC, a decline of roughly 4,642 BTC. At prevailing prices, the drop represents about $391 million of Bitcoin.<\/p>\n

\"Bitget\"Bitget
Bitget\u2019s tracked Bitcoin balance hovered near 30,000 BTC before briefly rising above 35,000 and then declining. Source: DeFiLlama<\/figcaption><\/figure>\n

The reserve decline is larger than the amount Chen said Bitget had processed through customer withdrawal orders. DeFiLlama tracks assets held in wallets attributed to exchanges, meaning changes can also reflect wallet movements or differences in address coverage rather than customer withdrawals alone.<\/p>\n

Still, the rapid outflow provides the first indication of how users are responding after Bitget froze withdrawals for four days while investigating the largest security incident in its eight-year history.<\/p>\n

Bitget restored Bitcoin withdrawals at 08:00 UTC on Sept. 28 after completing additional checks on its withdrawal infrastructure. Ethereum withdrawals are scheduled to follow on Sept. 29, USDT on Sept. 30, and remaining tokens, fiat, and peer-to-peer services on Oct. 2.<\/p>\n

The restart comes as Bitget attempts to reassure customers that the attack did not compromise its private keys or cold-wallet reserves.<\/p>\n

Chen said a completed internal trace found that attackers exploited vulnerabilities in third-party products to obtain internal credentials. Those credentials were then used to submit fraudulent withdrawal instructions that bypassed Bitget\u2019s risk controls.<\/p>\n

The exchange has isolated affected systems, revoked and reissued internal credentials, and restructured access to sensitive infrastructure, Chen said. Bitget also disabled the affected third-party functionality while the vendor works on a fix.<\/p>\n

Blockchain security firms, including Mandiant and SlowMist, continue to assist with forensic analysis and attempts to trace the stolen assets. Bitget previously said the incident involved a critical backend system in its wallet infrastructure and that it had remediated the vulnerability before withdrawals began returning.<\/p>\n

Bitget has said customers will bear no losses from the incident and that its Protection Fund will cover the shortfall. Chen said the company plans to replenish the fund with its own capital to more than $300 million within a week.<\/p>\n

\n

Related Reading<\/span><\/p>\n

Bitget\u2019s hack just got $36 million bigger, and now there\u2019s a bounty on the stolen crypto<\/h3>\n<\/p>\n

<\/span> <\/div>\n

Stolen funds move as THORChain resists calls to intervene<\/h2>\n

Meanwhile, recovering the stolen Bitget funds is becoming more difficult as the assets are fragmented across bridges, cross-chain protocols and privacy services.<\/p>\n