A wallet linked to the theft of $387.5m from Bitget has withdrawn about $1.23m in ether from Binance, two days before bitcoin withdrawals are due to reopen at Bitget on Monday.
Blockchain tracking service Lookonchain reported that wallet 0x4885 withdrew 257.6 ETH, worth about $692,000, and 545,000 USDT from Binance on Sept. 25. The USDT was exchanged for a further 200.2 ETH before all 457.9 ETH was transferred to an address associated with the Bitget hacker.
The funds were moved through several separate transactions. Bitget and Binance have said they are co-operating to trace the stolen assets. Withdrawals from Binance generally involve a verified account, potentially giving investigators information about the route taken by the money.
The transfer represents only a small part of the overall loss. Bitget increased its estimate from $351.6m to about $390m after including transactions involving Zcash and Tron. Arkham’s analysis put the theft at about $350m across seven blockchains.
Bitget has said the vulnerability has been fixed and has published a phased timetable for reopening withdrawals. Trading and deposits continued throughout the incident, while the exchange said customer balances were unaffected. Each stage of the withdrawal process is scheduled to begin at 08:00 UTC.
The first asset to become available will be bitcoin. Onchain analyst Yu Jin said that decision was significant because Bitget’s Protection Fund is held entirely in BTC. Users seeking to withdraw quickly may convert their holdings into bitcoin on the platform, allowing Bitget to meet those requests directly from its reserve rather than selling assets on the open market.
Bitget’s August report valued the fund at 5,500 BTC, with an average August value of $382m. At a bitcoin price of about $84,000, the reserve would be worth roughly $462m. That is consistent with chief executive Gracy Chen’s statement that the fund contained more than $464m and “covers the full loss”.
The $387.5m loss is equivalent to about 84% of the reserve at the current bitcoin price. Dividing the loss by 5,500 BTC gives a break-even price of approximately $70,455 per bitcoin, around 16% below its current level.
Bitget has not said whether it would replenish the fund if bitcoin’s value fell. For now, the reserve and the asset being made available first are both bitcoin.
Much of the stolen cryptocurrency cannot be recovered through issuer intervention. Circle and Tether have frozen the wallet identified as “Bitget Exploiter 8”, but Misttrack data indicates that other addresses controlled by the attacker still hold more than 63,000 ETH. Around $157m in XRP is also held in wallets that cannot be frozen.
Arkham recorded the attackers moving $228m within 18 minutes. Chen has told reporters that internet protocol patterns and onchain signatures indicate links to North Korea-linked hackers, using methods similar to those involved in the Bybit theft in 2025.
