Bitget’s tracked Bitcoin reserves fell by about 4,642 BTC after the exchange reopened withdrawals on Sept. 28, highlighting the immediate customer response following its $387.5 million hack. Chief Executive Officer Gracy Chen said Bitget had processed 9,585 withdrawal orders totaling 4,098.036 BTC by 17:00 UTC+8, while DeFiLlama data showed tracked Bitcoin falling to about 30,770 BTC from 35,412 BTC. At prevailing prices, the reserve decline represented about $391 million. Because DeFiLlama tracks exchange-attributed wallets, the difference may also reflect wallet movements or address-coverage changes rather than withdrawals alone. Bitget restored Bitcoin withdrawals at 08:00 UTC on Sept. 28 after additional infrastructure checks. Ethereum withdrawals are scheduled for Sept. 29, USDT for Sept. 30, and remaining tokens, fiat and peer-to-peer services for Oct. 2. Chen said attackers exploited vulnerabilities in third-party products to obtain internal credentials and submit fraudulent withdrawal instructions that bypassed risk controls. Bitget said it isolated affected systems, revoked and reissued credentials, restructured access to sensitive infrastructure and disabled the affected third-party functionality. Mandiant and SlowMist are assisting with forensic work and asset tracing. Bitget has said customers will suffer no losses, with its Protection Fund covering any shortfall, and Chen said the company plans to replenish the fund with its own capital to more than $300 million within a week. Meanwhile, investigators say the stolen funds are being fragmented across bridges, cross-chain protocols and privacy services. ZachXBT said Chinese illicit actors were laundering proceeds for hackers allegedly linked to North Korea through chain-hopping and mixing services including Wasabi. The dispute has drawn attention to THORChain, which says it will not selectively block wallets or swaps, while GoPlus argues that its node operators retain emergency powers through threshold-signature vaults, signing halts and Mimir governance. GoPlus estimated that about 101.5 BTC, worth roughly $8.5 million, had exited through THORChain and that another 27.63 million XRP, valued at about $43 million, was being converted into Bitcoin. The debate is focused on whether permissionless protocols with emergency controls should remain transaction-neutral when handling funds from major hacks.