By Bitcoin News | Created at 2026-09-26 12:17:32 | Updated at 2026-09-26 13:57:34
4 hours ago
A wallet tied to Bitget’s $387.5 million hacker pulled about $1.23 million in ether out of Binance, two days before the exchange reopens bitcoin withdrawals on Monday.
Key Takeaways
- Lookonchain flagged 457.9 ETH, worth $1.23M, moving from Binance to the attacker’s wallet.
- Bitget’s 5,500 BTC Protection Fund, worth about $462M, covers the $387.5M loss as long as BTC stays above $70K.
- Bitget reopens BTC withdrawals Sept. 28, then ETH, USDT and all other assets in phases through Oct. 2.
The Refuel, Step by Step
The attacker who drained Bitget on Sept. 24 is still moving money, and some of it came via a rival exchange. Blockchain sleuth Lookonchain reported today that wallet 0x4885 withdrew 257.6 ETH (about $692,000) and 545,000 USDT from Binance. The wallet swapped the USDT for another 200.2 ETH, then sent all 457.9 ETH, roughly $1.23 million, to the Bitget hacker’s address.
The withdrawals were spread across several separate transfers on Sept. 25, and Bitget and Binance have said they are working together to trace the stolen funds.
A Binance withdrawal usually leaves a verified account behind, which gives investigators a thread to pull.
The amount is small next to the haul, given Bitget raised its loss estimate from $351.6 million to about $390 million after counting transfers on Zcash and Tron. CEO Gracy Chen said:
[The attacker] compromised a critical backend system within our wallet infrastructure, used it to spoof transaction data, and triggered our authorization process to move funds out.
In plainer terms, Bitget’s own approval system signed off on the theft.
Why Bitcoin Goes First
Bitget says the flaw is now fixed, and subsequently published a phased withdrawal schedule. Trading and deposits never stopped, and the exchange says user balances are unaffected. Every phase opens at 08:00 UTC:
- Sept. 28: bitcoin (BTC)
- Sept. 29: ether (ETH) on Ethereum, BNB Smart Chain (BSC), Arbitrum, Base and Optimism
- Sept. 30: tether (USDT) on Ethereum, BSC, Solana and Tron
- Oct. 2: all other tokens, fiat and peer-to-peer (P2P) services
Onchain analyst Yu Jin pointed out that the order isn’t random: Bitget’s Protection Fund is held entirely in BTC. Opening bitcoin first nudges impatient users to swap their holdings into BTC on the platform and pull that out. If they do, Bitget can pay withdrawals straight from its reserve without selling coins on the open market.
Bitcoin’s Price Is Now Bitget’s Backstop
This is where the bitcoin price stops being a market story and becomes a solvency question. Bitget’s own August report lists the fund at 5,500 BTC, with an August average value of $382 million. At bitcoin’s current price of roughly $84,000, those coins are worth about $462 million. That matches Chen’s claim that the fund held more than $464 million and “covers the full loss.”
To elaborate further, the $387.5 million loss equals about 84% of the fund at today’s price. Divide the loss by 5,500 coins and the break-even comes out near $70,455 per BTC, about 16% below where bitcoin trades now.
Bitget has not said whether it would top up the fund if bitcoin slides. For now, the backstop and the asset that gets paid out first are the same coin.
What Is Still Loose
Most of the loot is out of reach as Circle and Tether have frozen the wallet labeled “Bitget Exploiter 8.” Misttrack data shows other attacker addresses still holding more than 63,000 ETH, which no issuer can freeze. The largest single chunk, about $157M in XRP, sits in wallets that can’t be frozen either.
Lastly, Arkham tracked the attackers moving $228M in 18 minutes as Chen told reporters that IP patterns and onchain signatures point to North Korea-linked hackers, the same playbook behind the Bybit theft in 2025. For the full backstory, Bitcoin.com News has a running summary of everything known about the breach.
