Bitget Hack: $387M in Crypto Being Laundered, 5K BTC Moved

Bitget Outflows Follow Hack Resolution

Approximately 5,000 Bitcoin (BTC) has exited Bitget’s tracked reserves after the exchange partially restored withdrawal services following a security breach that saw $387.5 million in crypto stolen. Bitget processed 4,098.036 BTC in 9,585 withdrawal orders as of September 28th, according to CEO Gracy Chen.

Data from DeFiLlama indicates a larger outflow, showing Bitget’s tracked Bitcoin balance decreased by roughly 4,642 BTC, representing approximately $391 million at current prices. This decline, from 35,412 BTC to around 30,770 BTC, exceeds the amount Chen reported as processed through customer withdrawals, suggesting additional wallet movements beyond direct user activity.

Laundering Operations Underway

Blockchain investigator ZachXBT reports that Chinese illicit actors are laundering the stolen funds on behalf of hackers allegedly linked to North Korea. The funds are being moved across multiple blockchains and deposited into privacy-focused mixing services like Wasabi. The laundering network has connections to previous exploits, including the $292 million Kelp DAO hack.

THORChain at the Center of Debate

The movement of stolen funds through THORChain has sparked controversy. Security firm GoPlus argues THORChain has the ability to intervene and halt transactions linked to the hack, citing its internal controls. However, THORChain maintains its commitment to censorship resistance, refusing to selectively block wallets or swaps, and drawing comparisons to Bitcoin and Ethereum. GoPlus estimates that approximately 101.5 BTC ($8.5 million) and 27.63 million XRP ($43 million) have already passed through THORChain from the Bitget exploit, generating fees for the protocol.

Bitget has stated that customers will not bear losses from the incident and plans to replenish its Protection Fund to over $300 million. The exchange has isolated affected systems and revoked internal credentials following the attack, which exploited vulnerabilities in third-party products.

Source: CryptoSlate