Bitget hacker moves first stolen funds after $350 million September 24 breach

The wallet linked to the Bitget hack has started moving stolen funds for the first time since the exchange lost more than $350 million in a September 24 security breach. For PSPs and other operators watching high-risk crypto flows, the important part is not just the theft itself, but the speed and route of the subsequent laundering trail.

1. On Monday, on-chain trackers identified a key address linked to the attacker transferring Ethereum (ETH) into THORChain vaults and quickly converting the assets into Bitcoin (BTC). That is the first major movement of funds since the incident.
2. Bitget initially estimated losses at approximately $351.6 million, but later tracing lifted the confirmed total to about $387.5 million after additional assets were tied to the same attack.
3. Blockchain data shows the attacker sending ETH to THORChain in multiple transactions, often in batches of 100 ETH, before swapping into BTC through the decentralized cross-chain protocol. Earlier movements involving stolen XRP, BNB, and TRX were also routed through THORChain and similar bridging services before being converted into Bitcoin.
4. Some of the resulting BTC has reportedly been processed using transaction-obfuscation techniques, which makes tracing harder once the funds have been consolidated and moved further away from the original wallets.
5. Bitget said the attackers did not obtain private keys. Instead, the breach allegedly involved compromise of a critical backend component that let fraudulent transaction data pass through the exchange’s authorization process. The attack affected Ethereum, XRP, stablecoins, BNB, AVAX, and Tron-based tokens, while Bitget’s cold wallets and separate self-custodial wallet service were not impacted.

Bitget has published attacker-linked wallet addresses and asked industry participants to help freeze and recover the stolen funds. It also asked THORChain to block the identified wallets, but the protocol said its permissionless network cannot selectively restrict addresses. Withdrawals resumed on September 28, starting with Bitcoin and then other assets in phases.