Bitget first told users $351.6 million was gone; after Zcash and Tron transfers the final tally is $387.5 million. BTC withdrawals came back Monday, ETH and USDT are queued for the next two days — and the attacker is still cashing out through THORChain while North Korea-linked actors launder through Discord and Telegram. You love to see it.
▪️ The Sept. 24 breach hit Bitget's hot and warm wallet infrastructure. Cold wallets survived — that's the only part of the stack that did. Shocking, right?
▪️ BTC came back first on the Bitcoin network and BNB Smart Chain. CEO Gracy Chen said the withdrawal pipeline had to be rebuilt and checked before anything else opened.
▪️ Ether returns across Ethereum, BNB Smart Chain, Arbitrum, Base and Optimism; USDT across Ethereum, BNB Smart Chain, Solana and Tron.
▪️ No priority lane: institutions, VIP customers and Bitget staff wait in the same queue as everybody else, Chen said. So much for VIP treatment.
▪️ The attacker is swapping stolen ETH for BTC through THORChain vaults — Lookonchain caught the swaps, Arkham traced the ETH flowing in.
▪️ THORChain calls its halt a blanket emergency brake, "not a selective freeze of specific funds or an individual swap", and has no address blacklist — so Chen's demand to cut off the attacker asks for…
📊 ETH withdrawals:
Tuesday📊 USDT withdrawals:
Wednesday📊 Other assets, P2P:
FridayIf your coins sit on Bitget, you're in the same line as everyone else and you find out this week whether the pipe holds. The North Korea link means the stolen stack is gone and funding the next job — nobody gets it back. And the THORChain halt is the real tell: the only brake anyone has hurts every honest swapper on the network, not just the thief. Don't cry when your withdrawal says pending.
💬 «We restored BTC first because the withdrawal pipeline is the first to be completed.» — Bitget CEO Gracy Chen
🔮 Hot wallets drained, North Korea laundering in Discord group chats, and you're still keeping your rent on an exchange. Bold.
@pixeos
