September 28, 2026
Bitget Hack & Withdrawals — comic cyberpunk vault breach with correct spelled title

Bitget Hack & Withdrawals

Active · Beat: Crypto Wire · Last updated Sep 28, 2026, 10:54 a.m. PDT (Los Angeles)

First chapterLatest chapter

What’s new

Chen tells The Block the attacker probed with two sub-threshold transfers—0.184 ETH and 193 TRX at 18:31 UTC Sept. 24—before a 17-tx ~$361 million wave; reconciliation hit at 19:05 UTC. Protection fund (~$465M Sept. 25) absorbs the loss and aims to refill to at least $300M within a week. ETH still Sep 29. Trail hops stay on the THORChain / Wasabi tracker.

Timeline

  1. Sep 28, 2026Chen: sub-threshold test transfers before ~$361M drain waveThe Block interview clock + fund replenish-to-$300M; incident report this week.
  2. Sep 28, 2026Chen AMA: ~4,098 BTC processed; BSC BTC also restoredLivestream throughput print + equal-access claim; ETH still Tuesday.
  3. Sep 28, 2026Bitget pins $388M exploit on third-party security productThe Block statement: BTC processing on schedule; third-party product → credentials → fraudulent withdrawal commands; Protection Fund 5,500 BTC claim.
  4. Sep 28, 2026BTC withdrawals reopen on Bitcoin networkPhase one: schedule + route monitors show native BTC Open; early BSC read still closed.
  5. Sep 27, 2026THORChain answers Bitget’s refuse-service askProtocol says it is permissionless like Bitcoin, Ethereum, and BNB Chain — trail desk, not a reopen update.
  6. Sep 26, 2026AMLBot maps Bitget-linked BTC into Wasabi after ThorchainOn-chain hop while withdrawals stay paused.
  7. Sep 26, 2026Gracy Chen asks Thorchain to refuse attacker addressesExchange pressure shifts from recovery bounty to cross-chain cooperation.
  8. Sep 26, 2026Hacker wallet pulls ~$1.23M ETH from BinanceLookonchain-style refuel after the XRP move.
  9. Sep 26, 2026Attacker moves ~$83M stolen XRPNative XRPL stack foundations cannot freeze.
  10. Sep 25, 2026Phased withdrawals: BTC Sep 28 → ETH 29 → USDT 30 → rest Oct 2Operational calendar driving the reopen watch.
  11. Sep 25, 2026Loss revised to ~$387.5M with 5% freeze/recovery bountiesTotals upgraded; retail reopen still pending.
  12. Sep 24, 2026Hot/warm wallet drain confirmed; withdrawals pausedOpening chapter: ~$351.6M incident and exchange-wide pause.

What’s next

  • September 29 — ETH reopen. Watch for queue failures, partial freezes, or delay.
  • Formal incident report (Mandiant / SlowMist) — Chen declined to name the suspected group until then.
  • September 30 — USDT reopen.
  • October 2 — remaining assets / fiat / P2P. Stop when reopen looks routine with no new incidents and the fund trail is quiet ~48h with no new primary source.

Briefing card · THORChain / Wasabi tracker · Latest News · All Story Trackers