{"id":78693,"date":"2026-09-26T10:30:10","date_gmt":"2026-09-26T10:30:10","guid":{"rendered":"https:\/\/crowdfundjunction.com\/blog\/hacker-just-refueled-on-binance-as-withdrawals-reopen-monday-bitcoin-news\/"},"modified":"2026-09-26T10:30:10","modified_gmt":"2026-09-26T10:30:10","slug":"hacker-just-refueled-on-binance-as-withdrawals-reopen-monday-bitcoin-news","status":"publish","type":"post","link":"https:\/\/crowdfundjunction.com\/blog\/hacker-just-refueled-on-binance-as-withdrawals-reopen-monday-bitcoin-news\/","title":{"rendered":"Hacker Just Refueled on Binance as Withdrawals Reopen Monday \u2013 Bitcoin News"},"content":{"rendered":"<p><b>(Originally posted on : Bitcoin News )<\/b><br \/>\n<\/p>\n<div>\n<div class=\"@container mb-[25px] rounded-sm overflow-clip py-0.5 pr-0.5 pl-2.5 bg-success-100\">\n<div class=\"flex flex-col gap-m overflow-clip rounded-[6px] !bg-success-10 p-3 @[420px]:p-m\">\n<h2 class=\"m-0 flex items-center gap-s text-[19px] !text-[#1c1c1c] md:text-[20px]\"><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"16\" height=\"10\" viewbox=\"0 0 16 10\" fill=\"none\" class=\"shrink-0 text-success-100\" aria-hidden=\"true\"><path d=\"M1 1.5h14\" stroke=\"currentColor\" stroke-width=\"2.5\" stroke-linecap=\"round\"\/><path d=\"M1 8.5h10\" stroke=\"currentColor\" stroke-width=\"2.5\" stroke-linecap=\"round\"\/><\/svg><span>Key Takeaways<\/span><\/h2>\n<ul class=\"m-0 flex list-none flex-col gap-m pl-0\">\n<li class=\"m-0 flex items-start gap-s !text-[#434248]\"><span class=\"mt-2 size-2 shrink-0 rounded-full bg-success-100\" aria-hidden=\"true\"\/><span class=\"text-body\">Lookonchain flagged 457.9 ETH, worth $1.23M, moving from Binance to the attacker\u2019s wallet.<\/span><\/li>\n<li class=\"m-0 flex items-start gap-s !text-[#434248]\"><span class=\"mt-2 size-2 shrink-0 rounded-full bg-success-100\" aria-hidden=\"true\"\/><span class=\"text-body\">Bitget\u2019s 5,500 BTC Protection Fund, worth about $462M, covers the $387.5M loss as long as BTC stays above $70K.<\/span><\/li>\n<li class=\"m-0 flex items-start gap-s !text-[#434248]\"><span class=\"mt-2 size-2 shrink-0 rounded-full bg-success-100\" aria-hidden=\"true\"\/><span class=\"text-body\">Bitget reopens BTC withdrawals Sept. 28, then ETH, USDT and all other assets in phases through Oct. 2.<\/span><\/li>\n<\/ul>\n<\/div>\n<\/div>\n<h2>The Refuel, Step by Step<\/h2>\n<p>The attacker who drained Bitget on Sept. 24 is still moving money, and some of it came via a rival exchange. Blockchain sleuth Lookonchain <a href=\"https:\/\/x.com\/lookonchain\/status\/2103700414608892398\" target=\"_blank\" rel=\"noopener noreferrer\">reported today<\/a> that wallet 0x4885 withdrew 257.6 ETH (about $692,000) and 545,000 USDT from Binance. The wallet swapped the USDT for another 200.2 ETH, then sent all 457.9 ETH, roughly $1.23 million, to the Bitget hacker\u2019s address.<\/p>\n<p>The withdrawals were spread across several separate transfers on Sept. 25, and Bitget and Binance have said they are working together to trace the stolen funds.<\/p>\n<p>A Binance withdrawal usually leaves a verified account behind, which gives investigators a thread to pull.<\/p>\n<p>The amount is small next to the haul, given Bitget raised its loss estimate from $351.6 million to <a href=\"https:\/\/www.ft.com\/content\/14aed3cb-492e-45c1-b217-869790b6130d?syn-25a6b1a6=1\" target=\"_blank\" rel=\"noopener noreferrer\">about $390 million<\/a> after counting transfers on Zcash and Tron. CEO Gracy Chen said:<\/p>\n<blockquote>\n<p>[The attacker] compromised a critical backend system within our wallet infrastructure, used it to spoof transaction data, and triggered our authorization process to move funds out.<\/p>\n<\/blockquote>\n<p>In plainer terms, Bitget\u2019s own approval system signed off on the theft.<\/p>\n<h2>Why Bitcoin Goes First<\/h2>\n<p>Bitget says the flaw is now fixed, and subsequently published a phased withdrawal schedule. Trading and deposits never stopped, and the exchange says user balances are unaffected. Every phase opens at 08:00 UTC:<\/p>\n<ul>\n<li style=\"font-weight:400\" aria-level=\"1\">Sept. 28: bitcoin (BTC)<\/li>\n<li style=\"font-weight:400\" aria-level=\"1\">Sept. 29: ether (ETH) on Ethereum, BNB Smart Chain (BSC), Arbitrum, Base and Optimism<\/li>\n<li style=\"font-weight:400\" aria-level=\"1\">Sept. 30: tether (USDT) on Ethereum, BSC, Solana and Tron<\/li>\n<li style=\"font-weight:400\" aria-level=\"1\">Oct. 2: all other tokens, fiat and peer-to-peer (P2P) services<\/li>\n<\/ul>\n<p>Onchain analyst Yu Jin <a href=\"https:\/\/x.com\/ai_9684xtpa\/status\/2103698145922425211\" target=\"_blank\" rel=\"noopener noreferrer\">pointed out that the order isn\u2019t random<\/a>: Bitget\u2019s Protection Fund is held entirely in BTC. Opening bitcoin first nudges impatient users to swap their holdings into BTC on the platform and pull that out. If they do, Bitget can pay withdrawals straight from its reserve without selling coins on the open market.<\/p>\n<h2>Bitcoin\u2019s Price Is Now Bitget\u2019s Backstop<\/h2>\n<p>This is where the bitcoin price stops being a market story and becomes a solvency question. Bitget\u2019s own August report <a href=\"https:\/\/www.bitget.com\/blog\/articles\/bitget-protection-fund-382m-august-2026\" target=\"_blank\" rel=\"noopener noreferrer\">lists the fund at 5,500 BTC<\/a>, with an August average value of $382 million. At bitcoin\u2019s current price of roughly $84,000, those coins are worth about $462 million. That matches Chen\u2019s claim that the fund held more than $464 million and \u201ccovers the full loss.\u201d<\/p>\n<p>To elaborate further, the $387.5 million loss equals about 84% of the fund at today\u2019s price. Divide the loss by 5,500 coins and the break-even comes out near $70,455 per BTC, about 16% below where bitcoin trades now.<\/p>\n<p>Bitget has not said whether it would top up the fund if bitcoin slides. For now, the backstop and the asset that gets paid out first are the same coin.<\/p>\n<h2>What Is Still Loose<\/h2>\n<p>Most of the loot is out of reach as Circle and Tether have frozen the wallet labeled \u201cBitget Exploiter 8.\u201d Misttrack data shows other attacker addresses still holding more than 63,000 ETH, which no issuer can freeze. The largest single chunk, about <a href=\"https:\/\/news.bitcoin.com\/exchanges\/bitget-hack-xrp-157m-cannot-be-frozen\/\">$157M in XRP<\/a>, sits in wallets that can\u2019t be frozen either.<\/p>\n<p>Lastly, Arkham tracked the attackers moving <a href=\"https:\/\/news.bitcoin.com\/featured\/bitget-hackers-drain-228m-in-18-minutes-arkham-tracks-7-chains\/\">$228M in 18 minutes<\/a> as Chen told reporters that IP patterns and onchain signatures point to <a href=\"https:\/\/www.cnbc.com\/2026\/09\/25\/crypto-platform-bitget-suspects-north-korea-in-352-million-hack.html\" target=\"_blank\" rel=\"noopener noreferrer\">North Korea-linked hackers<\/a>, the same playbook behind the Bybit theft in 2025. For the full backstory, Bitcoin.com News has a running summary of <a href=\"https:\/\/news.bitcoin.com\/featured\/everything-we-know-about-bitgets-massive-351m-hack\/\">everything known<\/a> about the breach.<\/p>\n<\/p><\/div>\n<p><a href=\"https:\/\/news.bitcoin.com\/exchanges\/bitget-hacker-binance-withdrawals-reopen-bitcoin-first\/\">Source link <\/a><br \/>\n<br \/><\/p>\n","protected":false},"excerpt":{"rendered":"<p>(Originally posted on : Bitcoin News ) Key Takeaways Lookonchain flagged 457.9 ETH, worth $1.23M, moving from Binance to the attacker\u2019s wallet. Bitget\u2019s 5,500 BTC Protection Fund, worth about $462M, covers the $387.5M loss as long as BTC stays above $70K. Bitget reopens BTC withdrawals Sept. 28, then ETH, USDT and all other assets in [&hellip;]<\/p>\n","protected":false},"author":3947362404,"featured_media":78694,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0},"categories":[32],"tags":[],"_links":{"self":[{"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/posts\/78693"}],"collection":[{"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/users\/3947362404"}],"replies":[{"embeddable":true,"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/comments?post=78693"}],"version-history":[{"count":0,"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/posts\/78693\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/media\/78694"}],"wp:attachment":[{"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/media?parent=78693"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/categories?post=78693"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/tags?post=78693"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}