Bitget Resumes Bitcoin Withdrawals After Hacker Swaps ETH via THORChain

Bitget has resumed Bitcoin withdrawals following a security incident in which a wallet linked to the attacker was observed routing Ethereum through THORChain, the decentralized cross-chain liquidity protocol, in what on-chain investigators describe as a characteristic post-exploit fund movement pattern.

Bitget restores Bitcoin withdrawals after security incident

The exchange announced the resumption of Bitcoin withdrawals after a temporary suspension implemented while security teams investigated the breach. Withdrawal suspensions of this kind are standard operational practice during active post-exploit reviews, allowing exchanges to audit wallet exposure and prevent further unauthorized outflows. For related coverage, see Bitget details Blockchain4Her for International Women's Day.

On-chain investigators have been actively tracing funds connected to the incident across multiple chains. Separate analysis found 4 BTC from the Bitget hack routed through Wasabi CoinJoin, a Bitcoin mixing protocol, illustrating that the attacker deployed obfuscation techniques across different chains simultaneously rather than relying on a single venue. For related coverage, see Bitcoin, Ether Swing After Unanimous Fed Rate Hike.

What users should check before withdrawing

No independently verified figures for total stolen funds, specific wallet addresses, or transaction hashes have been confirmed by the exchange or credentialed on-chain forensics firms at publication time. Users seeking to verify on-chain activity can consult Mempool.space for Bitcoin transactions and Etherscan for Ethereum-side movements tied to any publicly disclosed attacker addresses.

How the ETH swap via THORChain fits the incident

THORChain enables native cross-chain swaps without wrapped tokens or centralized intermediaries, making it a recurring venue for post-exploit fund movement. An attacker holding Ethereum can swap directly to Bitcoin or other supported assets without a KYC checkpoint, which complicates exchange-level blacklisting and chain-of-custody tracing. For related coverage, see MEXC CEO Vugar Usi Zade on Discovering Bitcoin and the Exchange’s Next Chapter.

The protocol’s response to the Bitget incident has itself been contested. THORChain rejected requests to blacklist wallets connected to the Bitget hack, citing its neutrality principles, a stance that drew commentary from Ethereum co-founder Vitalik Buterin on the limits of censorship resistance when applied to stolen funds. That debate exposes a structural tension in decentralized infrastructure: the permissionless architecture that reduces counterparty risk for legitimate users also reduces the effectiveness of reactive freezes after a breach.

Cross-chain swaps via protocols like THORChain convert a single-chain tracing problem into a multi-chain coordination problem. Recovery or freezing requires simultaneous action from multiple protocol teams with no contractual relationship to the affected exchange, which is why on-chain investigators typically focus on destination wallets at centralized off-ramps rather than attempting to halt mid-flight swaps.

What remains unconfirmed

The following material details have not been independently verified at publication time: the total volume of ETH swapped through THORChain, the specific transaction hashes or block heights involved, the identity or attribution of the attacker, and the full scope of assets affected beyond the Bitcoin withdrawal suspension. Any figures circulating in secondary reports should be treated as unconfirmed until Bitget or a credentialed on-chain forensics firm publishes primary documentation.

The parallel use of THORChain for ETH swaps and Wasabi CoinJoin for Bitcoin obfuscation points to a deliberate multi-protocol strategy, a pattern increasingly common in exchange exploits where attackers diversify across chains to dilute investigator focus. Whether Bitget’s resumption of withdrawals signals a full resolution of the security review or a partial clearance of specific wallet segments has not been formally stated in verified public communications reviewed for this article.

Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrency and digital asset markets carry significant risk. Always do your own research before making decisions.