The Bitget attacker has started moving money through Binance. On-chain sleuths traced a $1.23 million withdrawal from Binance hot wallets into an attacker-controlled address, with 457.9 ETH now consolidated there, marking a new cash-out phase in the $387.5 million breach, Crypto Briefing reported.
Bitget confirmed the higher $387.5 million figure overnight, up from $351.6 million after investigators found unaccounted Zcash and Tron holdings, not new theft. Over $157 million in XRP remains the largest single-chain loss, while the attacker keeps swapping seized USDC for ETH, which no issuer can freeze, crypto.news reported.
Related reading: Bitget confirms $351.6M hack, blames North Korea-linked attackers; Circle lets institutions borrow USDC against bitcoin.
5% bounty, twice
Bitget answered with money: 5% to anyone who helps freeze the stolen funds and another 5% to anyone who helps recover them, worth up to $19.4 million on each side. Circle and Tether have frozen about $318,000 so far (99,990 USDC and 218,023 USDT), and Bitget published the main attacker addresses across Ethereum, XRP Ledger, Zcash and Tron, Bitbase reported.
The bounty follows the Bybit playbook: its CEO publicly offered to help trace funds, noting Bitget returned the favor during Bybit's own hack.
Monday reopen: the schedule
Withdrawals return in phases from September 28: Bitcoin at 08:00 UTC, Ethereum on September 29, USDT on September 30, and remaining tokens plus fiat and P2P on October 2. CEO Gracy Chen hosts an AMA thirty minutes before the Bitcoin reopen, Crypto Times reported.
Bitget says the flaw is identified and remediated, balances are unaffected, and the $464 million protection fund covers the loss. It has not published a fresh fund valuation next to the higher $387.5 million figure.
Lazarus, or just North Korea?
Attribution is getting murky. Bitget and some trackers point at the Lazarus Group, but analysts note the word has become a catch-all for North Korean cyber operations rather than one crew, Cybernews reported. Either way, TRM Labs data showing North Korea behind three-quarters of 2026 crypto thefts keeps the state-actor theory as the base case.
What it means for Malaysian users
Mark Monday 4pm MYT: that is when Bitcoin withdrawals reopen first. Until then, expect a wave of fake refund and support-scam DMs, the standard second plague of every big hack. Real updates come only from Bitget's official channels, never from anyone messaging you first.
The market, remarkably, still does not care: bitcoin holds $84,000, the cap sits at $2.98 trillion and greed reads 74. Calm lasts only while users get paid, so Monday's reopen is the real test.
What to watch next
- Monday 4pm MYT: does the Bitcoin reopen run smoothly or queue for hours
- Bounty hunters: first freeze or recovery claim sets the tone
- Binance flows: whether the $1.23M trail gets cut off or keeps growing
- Full incident report: the promised root-cause analysis is still awaited