Hacker Just Refueled on Binance as Withdrawals Reopen Monday

A wallet linked by onchain analysts to the Bitget attacker has received fresh ether after withdrawals from Binance, adding a new trail for investigators as Bitget prepares to reopen withdrawals in stages.

Lookonchain reported that wallet 0x4885 withdrew 257.6 ETH, worth about $692,000, and 545,000 USDT from Binance. The wallet then swapped the USDT for another 200.2 ETH and sent a total of 457.9 ETH, worth roughly $1.23 million, to the address identified as belonging to the Bitget hacker.

The transfers reportedly took place across several separate transactions on Sept. 25. According to the source material, Bitget and Binance have said they are working together to trace the stolen funds.

Bitget’s loss estimate climbed after cross-chain transfers

Bitget’s estimated loss rose from $351.6 million to about $390 million after transfers on Zcash and Tron were included, according to the source material.

Bitget CEO Gracy Chen said the attacker “compromised a critical backend system within our wallet infrastructure, used it to spoof transaction data, and triggered our authorization process to move funds out.”

In practical terms, the company’s explanation indicates the attacker manipulated internal wallet systems so Bitget’s authorization process approved the outgoing transfers.

Withdrawals are set to return in phases

Bitget says the flaw has been fixed and that trading and deposits did not stop. The exchange also says user balances are unaffected.

The reopening schedule begins with bitcoin withdrawals at 08:00 UTC on Sept. 28. Ether withdrawals on Ethereum, BNB Smart Chain, Arbitrum, Base and Optimism are scheduled for Sept. 29. Tether withdrawals on Ethereum, BNB Smart Chain, Solana and Tron are scheduled for Sept. 30. All other tokens, fiat and peer-to-peer services are slated for Oct. 2.

Why bitcoin goes first

Onchain analyst Yu Jin argued that the order is significant because Bitget’s Protection Fund is held entirely in bitcoin.

Opening BTC withdrawals first could encourage users who want to exit quickly to convert other assets into bitcoin inside Bitget and withdraw BTC. That would allow the exchange to meet those withdrawals directly from its bitcoin reserve rather than sell assets into the market, according to the analysis cited in the source.

The protection fund now depends on bitcoin’s price

Bitget’s August report listed its Protection Fund at 5,500 BTC, with an August average value of $382 million. At a bitcoin price of roughly $84,000, those coins would be worth about $462 million.

That aligns with Chen’s statement that the fund held more than $464 million and could cover the full loss. Based on the reported $387.5 million loss figure, the loss would equal about 84% of the fund at the cited bitcoin price.

The break-even point is near $70,455 per BTC when dividing the reported $387.5 million loss by 5,500 BTC. The source material notes Bitget has not said whether it would top up the fund if bitcoin falls below that level.

Some funds are frozen, but major chunks remain outside issuer control

According to the source material, Circle and Tether have frozen the wallet labeled “Bitget Exploiter 8,” limiting access to part of the stolen stablecoin funds.

Misttrack data cited in the source says other attacker addresses still hold more than 63,000 ETH, which cannot be frozen by an issuer. The source also says about $157 million in XRP remains in wallets that cannot be frozen.

Arkham reportedly tracked attackers moving $228 million in 18 minutes. Chen also told reporters that IP patterns and onchain signatures point to North Korea-linked hackers, comparing the activity to the playbook behind the Bybit theft in 2025.

For now, Bitget’s recovery plan turns on two moving targets: investigators following the attacker’s latest funding trail, and bitcoin holding enough value to keep the exchange’s BTC-denominated protection fund above the reported loss.