Major Exchange hack routes $387.5M via DEXs

TLDR

Bitget has confirmed a roughly $387.5 million exchange hack, and the attackers are actively laundering funds through multiple DEX and cross chain routes.

1. The breach hit Bitgets hot and warm wallets on 24 Sep, with losses revised to about $387.5 million across several networks and assets, while cold storage stayed intact.
2. Hackers are moving funds through cross chain DEX infrastructure such as Thorchain, Chainflip, Uniswap, and CoinJoin mixers, limiting how much can realistically be frozen or recovered.
3. Bitget plans phased withdrawal reopenings and says its protection fund covers user balances, while the incident fuels a wider debate on DeFi neutrality and exchange custody risk.

Deep Dive

1. Breach Scale And Mechanics

Bitget says the attack on 24 Sep exploited a critical backend wallet component that let the attacker spoof transaction data so internal systems legitimately signed withdrawals to attacker addresses, without leaking private keys or touching cold wallets.TokenPost reports the initial loss estimate of $351.6 million was later revised to about $387.5 million after adding Zcash and TRON based assets.

Impacted funds span Ethereum and other EVM chains, the XRP Ledger, TRON, Zcash and more, including XRP, ETH, USDT, USDC, BNB, AVAX and TRX.Finbold notes that Bitget paused withdrawals, then scheduled a staged restart, beginning with Bitcoin on 28 Sep, ETH on 29 Sep, USDT on 30 Sep, and all other tokens plus fiat and P2P by 2 Oct.

Bitget states that user account balances are intact and that its User Protection Fund, holding over $464 million, will cover losses rather than passing them to customers.

2. Laundering Through DEXs And Mixers

Investigators have traced the attacker routing stolen funds through a web of decentralized and cross chain protocols, including Thorchain, Chainflip, Uniswap, 1inch Fusion, Stargate, Across and Relay, with tens of millions in XRP reportedly swapped into BTC and then scattered across addresses.A Bitcoin.com analysis highlights these routes.

In one documented path, funds moved from a Bitget TRON wallet to USDT, then bridged as USDT0 to Ethereum, converted to ETH, swapped via Thorchain into roughly 4.59 BTC, and finally mixed via a Wasabi CoinJoin round, making tracing far harder.TokenPost tracks this chain.

Circle and Tether have frozen a small fraction of related USDC and USDT, but most of the value sits in assets that are not centrally freezeable. For example, more than $80 million in stolen XRP has moved from holding wallets, with roughly $75 million remaining in accounts that Ripple cannot freeze under XRP Ledger rules.CoinDesk details these limits.

3. User Impact And What To Watch

A key near term question is Bitgets solvency and trust. One exchange update cited a 5,500 BTC protection fund worth about $462 million at recent prices, meaning the $387.5 million loss consumes roughly 84 percent of that buffer and depends on BTC staying above a certain level.Bitcoin.coms withdrawal schedule piece warns that a sharp BTC price drop could stress the fund.

At the protocol level, Bitgets CEO publicly urged Thorchain to block attacker addresses, but Thorchains response emphasized that it is permissionless infrastructure, similar in principle to Bitcoin or Ethereum, and generally does not censor flows of stolen funds.That exchange is covered here. This highlights a growing tension between exchange expectations and DeFis neutrality.

Confidence: high because multiple independent reports and Bitget statements align on timing, scale, and laundering routes.

Conclusion

The Bitget hack combines a large centralized wallet compromise with sophisticated multi chain laundering through DEXs, bridges and mixers, exploiting the limits of asset freezes in non custodial systems. If Bitgets protection fund performs as stated, direct user balance losses should be avoided, but the episode is likely to accelerate pressure on exchanges to harden infrastructure and on DeFi projects to clarify their stance on censoring clearly stolen funds.