Major Exchange hack routes $387.5M via DEXs

TLDR

Bitget, a large crypto exchange, has confirmed a $387.5 million hack, with stolen assets now being moved and mixed across multiple DEX and cross-chain protocols.

1. The breach hit Bitget hot and warm wallets across several networks, but the exchange says user balances will be covered by a large protection fund.
2. On chain traces show the attacker using Thorchain, Chainflip, Uniswap, 1inch Fusion and others to swap XRP, ETH and stablecoins into BTC and move it across addresses.
3. Bitget plans phased withdrawal restarts while investigators and partners freeze what they can, and the episode intensifies debate over how permissionless DeFi should handle known stolen funds.

Deep Dive

1. Scale And Mechanics Of The Hack

Bitget reports that about $387.5 million in crypto was transferred from its hot and warm wallet infrastructure to attacker controlled addresses during a September 24 breach, up from an initial $351.6 million estimate after adding Zcash and TRON assets to the tally. The hit spans XRP, ETH, major stablecoins such as USDT and USDC, BNB, AVAX, TRX and others, while cold wallets were not compromised and trading and deposits reportedly stayed live throughout. Bitget says the attacker did not steal private keys, but instead compromised a critical backend wallet system and spoofed transaction data so its internal authorization process signed what looked like legitimate transfers. The exchange is working with Mandiant, SlowMist, Binance and other partners to investigate and has pledged to make customers whole via a protection fund holding over 5,500 BTC and other reserves, as detailed in its withdrawal restart updates and coverage discussions in outlets like TokenPost and Crypto News.

2. How The Attacker Uses DEXs And Bridges

Blockchain analysis shows the hacker aggressively using decentralized rails to launder and move funds. Reports note flows where TRX is swapped for USDT0, bridged to Ethereum, converted into ETH, then pushed through THORChain for BTC, which is further mixed via CoinJoin rounds. Bitcoin.com and other outlets describe the attacker routing tens of millions in XRP through Thorchain vaults before swapping to BTC, and also using Chainflip, Uniswap, 1inch Fusion, Stargate, Across and Relay for cross chain and cross asset movement. Separate coverage highlights a wallet tied to the hack withdrawing roughly 457.9 ETH and hundreds of thousands in USDT from Binance and consolidating it into an attacker address, showing a blend of centralized exchanges and permissionless protocols in the laundering path.

3. User Impact And DeFi Governance Debate

Bitget has announced a phased schedule to reopen withdrawals, starting with Bitcoin then ETH, USDT and other assets over several days, positioning this as a real world test of its promise that customer balances are intact and covered by the protection fund. Analysts have pointed out that solvency depends on BTC staying above certain price levels, since the fund is denominated largely in bitcoin and the loss represents a significant fraction of its value. At the same time, CEO Gracy Chen publicly urged Thorchain to block known attacker addresses, arguing that decentralization should not shield stolen funds, while Thorchain and many community voices responded that base layer protocols must remain permissionless and neutral. Stablecoin issuers like Tether and Circle have frozen some tokens tied to the hack, but most ETH and XRP appear unrecoverable on chain.

Conclusion

This hack shows how a single backend failure at a centralized exchange can generate hundreds of millions of dollars in losses that rapidly traverse DEXs, bridges and other neutral infrastructure. For crypto users, the key practical angles are where custody sits, how robust an exchanges protection fund and withdrawal plan look, and how evolving norms around freezing stolen funds may reshape both DeFi governance and centralized venue policies in the months ahead.