Bitget Hack: $387M Drifts Into Bitcoin and Mixers

The Bitget theft has already sent a chill through desks that trade crypto alongside major pairs. BlockSec traced the bulk of the $387.5 million haul into Bitcoin, THORChain routes and CoinJoin mixing — a path that has kept most of the money out of reach so far.

The Funds That Slipped Through

Just $840,000 has been publicly frozen. The rest appears to have been split and rerouted within hours. That speed is not new, yet it still caught traders off guard when it hit a platform many viewed as relatively secure.

THORChain swaps allowed quick conversion without leaving obvious on-ramps for law enforcement. CoinJoin layers added further noise. The combination is familiar from earlier thefts, but the size here changes the stakes for liquidity on affected chains.

How Exchanges React When Money Disappears

Bitget has not yet issued a full post-mortem. Other platforms in the region tightened withdrawal rules within hours, a move that sometimes spills into thinner order books for BTC and ETH pairs. Liquidity providers who hedge those books saw spreads widen briefly on Monday.

Traders who keep inventory on centralised venues are now asking the same question they asked after the Ronin and Nomad incidents: how much of their own exposure sits behind similar controls. The answer varies by firm, and that uncertainty tends to reduce size in the near term.

Tracing Limits in Real Time

Blockchain analytics firms can follow the initial hops. After CoinJoin, however, attribution drops sharply. That leaves compliance teams at exchanges and OTC desks with fewer options for freezing downstream addresses. For anyone positioned long crypto and short fiat, the episode is a reminder that on-chain visibility does not always translate into recovery.

Central banks have already flagged mixing services in recent guidance. A tighter stance on those tools could slow future flows but will not unwind what has already happened here. The market has absorbed larger losses before without structural damage, yet each case still raises the cost of custody for retail and professional users alike.

What Desk Traders Are Doing

Some are shifting more collateral to self-custody wallets ahead of the weekend. Others are trimming leverage on perpetual contracts until the stolen coins stop moving. Watch for unusual clustering around known mixer addresses — that activity often precedes further exchange alerts.

If you've been watching this pair of events — the hack itself and the limited freeze — the pattern is clear enough. Recovery rates stay low when funds hit privacy tools early. That does not change overnight, and anyone still running large balances on the platform should size positions with that reality in view.