Nearly 5,000 BTC left Bitget's tracked reserves after the exchange reopened Bitcoin withdrawals following its $387.5 million hack. As users rushed to move funds, investigators raced to trace the stolen haul, which hackers routed through THORChain and tried to push through Near Intents. Near Intents' SHIELD system blocked most of that attempt, while THORChain refused to intervene.
Nearly 5,000 Bitcoin has left Bitget's tracked reserves since the exchange reopened Bitcoin withdrawals following its $387.5 million hack. The rapid outflow gives the first read on how users are responding after the exchange's biggest security incident in its eight-year history.
Withdrawals reopen, reserves fall faster than orders processed
Bitget restored Bitcoin withdrawals at 08:00 UTC on September 28, after freezing them for four days to investigate the breach. Chief Executive Officer Gracy Chen said the exchange had processed 9,585 withdrawal orders totaling 4,098.036 BTC as of 17:00 UTC+8. Yet separate DeFiLlama data showed Bitget's tracked Bitcoin balance falling to about 30,770 BTC from 35,412 BTC, a decline of roughly 4,642 BTC worth about $391 million — larger than the processed customer orders alone.
Chen said an internal trace found attackers exploited vulnerabilities in third-party products to obtain credentials, which were then used to submit fraudulent withdrawal instructions. Bitget has said customers will bear no losses and that it plans to replenish its Protection Fund with its own capital to more than $300 million within a week. Ethereum withdrawals follow on September 29, USDT on September 30, and remaining tokens on October 2.
THORChain lets funds through, Near Intents blocks $50 million
Recovering the stolen funds is getting harder as they scatter across bridges and cross-chain protocols. Bitget's public tracker lists 2,377 attacker addresses, and 1,497 of them are marked as having moved funds through THORChain swaps. Chen formally asked THORChain on September 26 to refuse service to those addresses. She said: "Decentralization is a design principle, not a shield for facilitating known stolen funds", according to CryptoPotato. THORChain refused, comparing its role to base-layer networks like Bitcoin and Ethereum.
Near Intents took a different approach. Its SHIELD risk system identified more than $50 million in attempted laundering flows tied to the hack. Just $166,000 slipped through, while another $503,000 was frozen mid-execution, according to Aurora co-founder Alex Shevchenko. Near Intents also said it would waive its share of Bitget's recovery bounty, a move Chen welcomed.
Sources: CryptoSlate, Bitcoin.com, CryptoPotato
Trading involves risk.
Risk Disclaimer
