Bitget said its investigation has identified the attack path behind a security breach that transferred approximately $387.5 million to attacker-controlled addresses. Cointelegraph reported Monday that the exchange attributed the incident to a third-party security vulnerability and said some stolen assets had been frozen, although Bitget had not disclosed the recovered amount. CoinDesk separately traced 27 successful THORChain swaps that moved about 2,390 Ether into 75.2 Bitcoin.
The exchange’s latest account points to a compromise of a critical backend system in its wallet infrastructure rather than a leak of private keys. Bitget said the attacker spoofed transaction data and triggered the authorization process to move funds. The company’s updated tracing raised the confirmed amount from an initial estimate of $351.6 million after adding assets on Zcash and Tron, but Bitget said the revision represented fuller accounting of the original incident rather than additional theft.
The movement through THORChain has become a central part of the recovery effort. CoinDesk reported that Bitget asked the decentralized protocol to stop serving addresses connected to the theft, but THORChain rejected the request. Its tracing found 27 completed swaps converting roughly 2,390 ETH into 75.2 BTC. Those transactions illustrate how stolen funds can move across assets and networks while exchanges, blockchain projects and investigators attempt to identify and freeze linked addresses.
Bitget said its cold wallets were unaffected and that its separate self-custodial Bitget Wallet product operates on different infrastructure and was not involved. The company also said the incident remained contained, with no further unauthorized transfers possible. Mandiant and SlowMist have been assisting the investigation, while Bitget has launched a recovery bounty program offering 5% of funds successfully frozen or recovered to eligible participants whose voluntary actions directly produce that result.
What it means for traders: the incident creates separate areas of attention for Ether and Bitcoin. The reported conversion of 2,390 ETH into 75.2 BTC represents movement of stolen assets rather than ordinary investment demand, so any related onchain flows need to be interpreted in that context. Further transfers from identified attacker addresses, asset freezes or recoveries could affect short-term exchange flows and market sentiment, while evidence that the breach remains contained would limit the risk of additional unauthorized outflows from Bitget.
The next developments to watch are Bitget’s full technical report, the amount of assets frozen or recovered and any further movement from the addresses identified by investigators. Traders will also monitor whether THORChain or other cross-chain services take additional action after Bitget’s request, and whether authorities or security firms provide evidence supporting the possible North Korea link under investigation. The confirmed $387.5 million total and the traced ETH-to-BTC swaps remain the key figures as the recovery process continues.