Community Trust ScoreVerified
A wallet tied to the Bitget hack moved $1.23 million worth of Ethereum from Binance on September 25 — one day before the exchange planned to reopen Bitcoin withdrawals. The total theft has now been revised up to $390 million.
The wallet, tagged 0x4885, pulled 257.6 ETH — roughly $692,000 — plus 545,000 USDT from Binance. The USDT didn’t sit idle. It got converted into 200.2 ETH almost immediately, bringing the total to 457.9 ETH, or about $1.23 million. All of it then went straight to the primary address linked to the Bitget exploit. Bitget and Binance are both working to trace these movements. Binance’s standard withdrawal process requires a verified account, which at least gives investigators something to work with — a potential trail, though not necessarily one that leads anywhere fast. The original theft figure was $387.5 million, but Bitget bumped that estimate to $390 million after factoring in additional transactions across Zcash and Tron.
$390 million. Across seven blockchains.
How the Hack Actually Happened
Gracy Chen, CEO of Bitget, said the attacker found and exploited a critical flaw in the exchange’s backend systems. The flaw let the hacker push through unauthorized transaction approvals — basically telling Bitget’s infrastructure to move funds it had no business moving. Bitget says it’s fixed the vulnerability and that user balances weren’t touched. Trading and deposits kept running without interruption throughout.
Arkham Intelligence tracked $228 million moving out of Bitget in just 18 minutes. That’s not a slow, careful operation. That’s someone who knew exactly what they were doing and had probably rehearsed it. Indicators — IP patterns, onchain signatures — point toward a North Korea-linked group, using methods that look pretty similar to what happened with the Bybit theft in 2025. Nothing confirmed yet, but the resemblance is hard to ignore.
The breach spread across seven blockchains, which is part of what makes recovery so complicated. Funds dispersed that widely don’t sit in one place waiting to be frozen.
Bitget’s Phased Withdrawal Plan
Bitcoin withdrawals were set to reopen Monday. Bitget’s Protection Fund is held entirely in BTC — 5,500 BTC, worth around $462 million at Bitcoin’s current price of roughly $84,000. The phased approach starts with Bitcoin on purpose. Users who want out quickly are being nudged to convert their holdings to Bitcoin first, which lets Bitget cover withdrawals directly from its reserves without having to sell anything on the open market. Smart, if it works. It avoids a fire sale that could tank prices and make things worse for everyone.
But there’s no word yet on what happens if Bitcoin’s price drops. Bitget hasn’t said anything about plans to replenish the Protection Fund if BTC falls hard. That’s a real gap. The fund looks solid at $84,000 per coin — it looks a lot thinner at $60,000.
What’s Still Out of Reach
Circle and Tether moved fast. They froze the wallet tagged “Bitget Exploiter 8,” locking up a chunk of the stolen stablecoins. But the hacker’s addresses still hold more than 63,000 ETH. Ethereum can’t be frozen by any issuer — it’s not that kind of asset. That ETH is basically untouchable by traditional means. And then there’s around $157 million in XRP sitting in wallets that are similarly beyond the reach of any freeze mechanism.
So the recoverable portion is probably a fraction of the total. The stablecoin freezes help, but they can’t claw back what’s already been converted and moved across chains.
The hacker’s use of Binance for the September 25 withdrawal is interesting — and maybe a mistake, or maybe not. Binance’s KYC requirements mean there’s at least an account attached to those withdrawals. Whether that account leads anywhere real, or whether it’s a dead end built from stolen identities, isn’t clear yet. Investigators are working it.
What’s clear is that 63,000-plus ETH sitting in those wallets isn’t going anywhere through legal freezing. It could be moved, mixed, bridged, converted — the options for someone with that much ETH and apparent technical sophistication are wide. Recovery of that portion depends almost entirely on tracing onchain movements fast enough to catch a conversion or flag an exchange deposit before the funds disappear further.
Bitget’s collaboration with Binance is ongoing. The broader investigation spans multiple blockchains and multiple jurisdictions. No arrests have been announced. No specific identity has been publicly confirmed.
The 5,500 BTC in Bitget’s Protection Fund sits at $462 million right now.
Frequently Asked Questions
How much did the Bitget hacker steal in total?
Bitget revised its loss estimate to $390 million after accounting for transactions across Zcash and Tron, up from an initial figure of $387.5 million on September 24.
Why is Bitget starting withdrawals with Bitcoin specifically?
Bitget’s Protection Fund is held entirely in BTC — 5,500 BTC worth roughly $462 million — so starting with Bitcoin lets the exchange cover withdrawals directly from reserves without selling assets on the open market.
Can the stolen Ethereum be frozen like the stablecoins were?
No. Circle and Tether froze the wallet tagged “Bitget Exploiter 8,” but the more than 63,000 ETH in the hacker’s addresses can’t be frozen by any issuer, leaving that portion effectively beyond immediate recovery through traditional means.
Why It Matters
The movement of funds from the Bitget hack highlights ongoing vulnerabilities in the cryptocurrency exchange ecosystem, as hackers exploit weaknesses to liquidate stolen assets. With the total theft amounting to $390 million, the incident not only raises concerns about the security measures in place at centralized exchanges but also underscores the broader implications for market trust and regulatory scrutiny within the crypto space. As stolen assets are shuffled across multiple blockchains, it becomes increasingly challenging for law enforcement to trace and recover these funds, further complicating the landscape of cryptocurrency security.
