Bitget Sees $463 Million Outflow As Users Pull Funds After $387.5 Million Crypto Hack

Bitcoin Withdrawals Surge As Bitget Users Pull Funds After Hack

More than $330 million worth of Bitcoin left Bitget within an hour of withdrawals restarting, as customers moved to take control of their assets after the exchange suffered a $387.5 million hack.

The rapid withdrawals came after Bitget froze customer withdrawals for four days while investigating the 24 September security incident, which targeted its hot wallets.

Bitcoin Withdrawals Surge After Bitget Reopens

Bitget CEO Gracy Chen said customers withdrew 4,098.036 BTC through 9,585 orders after Bitcoin withdrawals resumed at 08:00 UTC on 28 September.

At the time, the Bitcoin withdrawn was worth more than $334 million based on prevailing prices.

Chen said,

“The withdrawals actually stabilized a lot today. Those hundreds of millions [in bitcoin withdrawals] actually most of them happen on the first hour of the withdrawal restart.”

Bitget has been restoring services in stages as it carries out additional checks on its withdrawal infrastructure.

Bitcoin withdrawals reopened first, followed by Ethereum on 29 September and USDT on 30 September.

Remaining tokens, fiat withdrawals and peer-to-peer services are scheduled to resume on 2 October.

Bitget Reserves Show A Larger Bitcoin Outflow

Data from DeFiLlama showed Bitget’s tracked Bitcoin reserves falling from about 35,412 BTC to around 30,770 BTC, a decline of roughly 4,642 BTC.

At prevailing prices, that represents about $391 million in Bitcoin.

The difference between the reserve decline and the 4,098 BTC reported in customer withdrawal orders does not necessarily mean additional customers withdrew funds.

DeFiLlama tracks Bitcoin held in wallets attributed to exchanges, meaning reserve movements can also result from internal transfers or changes in the wallet addresses being tracked.

Across all crypto assets, however, Bitget recorded about $463 million in net outflows within 24 hours of the attack and the subsequent withdrawal restart, according to DeFiLlama data.

That was the largest single-day outflow recorded by the data provider for a centralised exchange since it began tracking reserves four years ago.

Bitget held roughly $5.84 billion in reserves, putting the $463 million outflow at close to 8% of its tracked holdings.

How Did Hackers Take $387.5 Million From Bitget?

Bitget said its internal investigation found that the attackers did not access its cold-storage funds or private keys.

Instead, Chen said the attackers exploited vulnerabilities in third-party products to obtain internal credentials.

Those credentials were then used to submit fraudulent withdrawal instructions that bypassed the exchange’s risk controls.

Chen said, “no cold storage funds were touched” and that the attackers had “exploited vulnerabilities from third-party products to steal internal credentials, then used those credentials to send fraudulent withdrawal commands that bypassed our risk controls.”

Bitget has since isolated affected systems, revoked and reissued internal credentials and changed access arrangements for sensitive infrastructure.

The exchange also disabled the affected third-party functionality while the vendor works on a fix.

Bitget described the incident as the first “security incident of this nature in eight years” and said that “The incident remains contained, and no further unauthorized transfers are possible.”

The exchange has also said customers will not bear losses from the attack.

Protection Fund Falls Below $200 Million After The Hack

Bitget’s Protection Fund has also taken a major hit following the incident.

The fund stood at more than $464 million before the hack but fell below $200 million afterwards, according to figures reported by Bloomberg on 29 September.

Chen said Bitget would use its own capital to replenish the fund, with the company aiming to bring it back above $300 million within a week.

That target is a company commitment rather than an independently audited figure.

The protection fund is intended to cover the shortfall from the attack and protect customers from losses linked to the incident.

North Korea Link Alleged As Stolen Funds Move Across Chains

Bitget has said the attack method was “highly consistent with known patterns of North Korean hacker organizations”.

Blockchain investigators have since tracked the stolen assets moving through different chains, bridges and services as efforts to recover the funds become more difficult.

ZachXBT said Chinese illicit actors were laundering proceeds from the exploit on behalf of hackers allegedly linked to North Korea, with the funds being moved between networks and into mixing services including Wasabi.

Security firms including Mandiant and SlowMist are assisting with the investigation and efforts to trace the stolen assets.

THORChain Faces Pressure Over Stolen Bitget Funds

The movement of the stolen assets has also put THORChain at the centre of a dispute over whether decentralised infrastructure should intervene when hacked funds pass through its network.

THORChain has maintained that it will not selectively block wallets or swaps, arguing that its role is similar to censorship-resistant networks such as Bitcoin and Ethereum.

Security firm GoPlus has challenged that position, arguing that THORChain’s architecture gives its node operators mechanisms that can be used to halt or restrict activity.

GoPlus estimated that about 101.5 BTC, worth roughly $8.5 million, had already moved through THORChain from the Bitget exploit, while another 27.63 million XRP, worth about $43 million, was being converted into Bitcoin.

The security firm also pointed to THORChain’s response to its own $10.7 million exploit in May, when the network was halted during the containment effort.

THORChain has rejected the comparison, saying a network-wide halt to protect its own protocol is different from selectively censoring a particular wallet or transaction.

As Bitget continues reopening withdrawals, the exchange is therefore dealing with two separate challenges: restoring customer confidence while investigators attempt to trace crypto that has already moved through multiple networks and services.