Bitget hack: Where did the stolen $387M go?

Discover the details of the Bitget hack where $387.5 million was stolen, exploring how attackers shifted the funds and the unfolding investigation.

In the aftermath of Bitget's staggering $387.5 million hack, many are left wondering: where did that vast sum of stolen cryptocurrency go? With the exchange declaring that attackers quickly shifted much of the funds to Bitcoin through a series of cross-chain services, the finer details of this sophisticated operation are slowly unfolding.

How Did the Bitget Hack Unfold?

The breach began on September 24, 2026, at 18:31 UTC, with unauthorized funds being transferred from Bitget's hot and warm wallets. Initially, tiny test transfers using 0.84 ETH and 93 TRX provided the attackers with a foothold. Just minutes later, larger withdrawals took place as Bitget's reconciliation system detected the discrepancies and promptly blocked regular customer withdrawals.

According to Bitget, the attackers exploited a vulnerability in a third-party security product, allowing them to gain high-level internal credentials to bypass user withdrawal protocols. Crucially, private keys remained secure, and cold wallets were untouched, containing no losses due to this breach.

What Happened to the Stolen Funds?

BlockSec, an analysis firm, discovered that substantial movements occurred in the five days after the hack. As reported, the stolen assets were quickly converted into assets that could be frozen. Within just 41 minutes of the initial theft, around $75.48 million in assets, including USDT and USDC, were moved into Ethereum or Avalanche using DeFi protocols like Uniswap and MetaMask. This conversion took place before Bitget's CEO, Gracy Chen, announced the breach publicly.

Why Is Only $840K of the $387M Frozen?

Post-attack, only about $840,000 of the stolen funds have been frozen, which equates to a mere 0.2% of the total theft. The extensive laundering operation enabled attackers to maintain control over approximately $342 million five days after the theft. This estimation indicates that an astonishing 83.7% of this amount, about 3,386 BTC, is currently held in Bitcoin.

How Did THORChain Factor Into the Laundering Process?

THORChain emerged as the primary cross-chain route used by attackers, facilitating the transfer of $269 million across 7,804 transactions, making it the most significant pathway of value movement. BlockSec raised concerns about THORChain's role as stolen Ethereum continued its conversion into Bitcoin, prompting Bitget's leadership to request that THORChain block known addresses associated with the theft.

What’s Next for Bitget and Its Users?

In a bid to regain user confidence, Bitget has reinstated USDT withdrawals following the incident. The exchange grapples with the aftermath while continuing to collaborate with investigative bodies like Mandiant and SlowMist, who confirmed the breach was linked to the compromised third-party software. Consequently, user withdrawals were rerouted to prevent further losses.

Could North Korea Be Involved?

Though North Korea remains a suspect in this precarious situation, BlockSec has emphasized that the on-chain evidence does not definitively point to the attackers' identity. The situation continues to evolve as investigations persist.

Key Takeaways:

• The Bitget hack, totaling $387.5 million, utilized cross-chain services to move funds.
• Only $840,000, or 0.2%, has been frozen from the total amount stolen.
• Bitcoin became the primary consolidation asset, with approximately 3,386 BTC controlled by the attackers.
• THORChain served as a major conduit for laundering stolen assets.
• Bitget is cooperating with multiple investigative firms to respond to the incident.

For those interested in robust trading options amid such turbulent times, platforms like Binance, Bybit, and Bitget offer competitive rates and much more. Be sure to explore our referral pages for special bonuses on these exchanges!