Bitget Saga: Hacker Just Refueled on Binance as Withdrawals Reopen Monday

The Refuel, Step by Step

The attacker who drained Bitget connected Sept. 24 is inactive moving money, and immoderate of it came via a rival exchange. Blockchain sleuth Lookonchain reported today that wallet 0x4885 withdrew 257.6 ETH (about $692,000) and 545,000 USDT from Binance. The wallet swapped the USDT for different 200.2 ETH, past sent each 457.9 ETH, astir $1.23 million, to the Bitget hacker’s address.

The withdrawals were dispersed crossed respective abstracted transfers connected Sept. 25, and Bitget and Binance person said they are moving unneurotic to hint the stolen funds.

A Binance withdrawal usually leaves a verified relationship behind, which gives investigators a thread to pull.

The magnitude is tiny adjacent to the haul, fixed Bitget raised its nonaccomplishment estimation from $351.6 cardinal to about $390 million aft counting transfers connected Zcash and Tron. CEO Gracy Chen said:

[The attacker] compromised a captious backend strategy wrong our wallet infrastructure, utilized it to spoof transaction data, and triggered our authorization process to determination funds out.

In plainer terms, Bitget’s ain support strategy signed disconnected connected the theft.

Why Bitcoin Goes First

Bitget says the flaw is present fixed, and subsequently published a phased withdrawal schedule. Trading and deposits ne'er stopped, and the speech says idiosyncratic balances are unaffected. Every signifier opens astatine 08:00 UTC:

• Sept. 28: bitcoin (BTC)
• Sept. 29: ether (ETH) connected Ethereum, BNB Smart Chain (BSC), Arbitrum, Base and Optimism
• Sept. 30: tether (USDT) connected Ethereum, BSC, Solana and Tron
• Oct. 2: each different tokens, fiat and peer-to-peer (P2P) services

Onchain expert Yu Jin pointed retired that the bid isn’t random: Bitget’s Protection Fund is held wholly successful BTC. Opening bitcoin archetypal nudges impatient users to swap their holdings into BTC connected the level and propulsion that out. If they do, Bitget tin wage withdrawals consecutive from its reserve without selling coins connected the unfastened market.

Bitcoin’s Price Is Now Bitget’s Backstop

This is wherever the bitcoin terms stops being a marketplace communicative and becomes a solvency question. Bitget’s ain August study lists the money astatine 5,500 BTC, with an August mean worth of $382 million. At bitcoin’s existent terms of astir $84,000, those coins are worthy astir $462 million. That matches Chen’s assertion that the money held much than $464 cardinal and “covers the afloat loss.”

To elaborate further, the $387.5 cardinal nonaccomplishment equals astir 84% of the money astatine today’s price. Divide the nonaccomplishment by 5,500 coins and the break-even comes retired adjacent $70,455 per BTC, astir 16% beneath wherever bitcoin trades now.

Bitget has not said whether it would apical up the money if bitcoin slides. For now, the backstop and the plus that gets paid retired archetypal are the aforesaid coin.

What Is Still Loose

Most of the loot is retired of scope arsenic Circle and Tether person frozen the wallet labeled “Bitget Exploiter 8.” Misttrack information shows different attacker addresses inactive holding much than 63,000 ETH, which nary issuer tin freeze. The largest azygous chunk, astir $157M successful XRP, sits successful wallets that can’t beryllium frozen either.

Lastly, Arkham tracked the attackers moving $228M successful 18 minutes arsenic Chen told reporters that IP patterns and onchain signatures constituent to North Korea-linked hackers, the aforesaid playbook down the Bybit theft successful 2025. For the afloat backstory, Bitcoin.com News has a moving summary of everything known astir the breach.