The exchange is restoring access in stages after a $387.5 million theft, with ether withdrawals scheduled for Tuesday and tether on Wednesday.
Bitget resumed bitcoin withdrawals on Monday as scheduled, the first step in a staged recovery from a $387.5 million hack that forced the exchange to halt withdrawals last week.
Ether withdrawals are set to reopen Tuesday, followed by USDT on Wednesday and all remaining assets on Oct. 2.
A sequenced restart
The order carries its own logic. Bitcoin is the asset customers are most likely to pull first, so meeting that demand on schedule is the fastest way to rebuild confidence. Ether and the dollar-pegged tether follow, with the long tail of smaller tokens last.
A staged approach lets the exchange measure outflows asset by asset rather than facing a simultaneous rush across every coin. The test comes over the next four days: if withdrawals in each asset run at a manageable pace, the exchange's balance sheet will look adequate. A surge that forces a delay would raise questions about reserves.
Tracing the money
The stolen funds were spread across seven blockchains, including Ethereum, the XRP Ledger, Arbitrum, Avalanche, Optimism, BNB Chain and Base. Investigators have tracked laundering patterns, including splitting funds into round-number wallets and routing them through swap services, that resemble past North Korean operations.
The attacker has already tested the defenses of decentralized infrastructure. THORChain allowed about $6.3 million in ether to be converted into bitcoin, while NEAR Intents froze a smaller slice of attempted transfers.
What is at stake
A formal North Korean attribution would change the story's scope. It would bring sanctions law into play for any exchange or protocol that touched the stolen funds, and raise the compliance stakes across the industry.
For Bitget customers, the immediate concern is simpler: whether each withdrawal window opens on time. Tuesday's ether restart is the next checkpoint, and the Oct. 2 opening for all remaining assets is the one that would mark a full return to normal operations.