Bitget processed 9,585 Bitcoin withdrawal orders totaling 4,098 BTC after reopening Bitcoin withdrawals on Sept. 28, following a four-day freeze after the $387.5 million hack. DeFiLlama data showed the exchange’s tracked Bitcoin reserves falling from 35,412 BTC to about 30,770 BTC, a decline of roughly 4,642 BTC worth about $391 million at current prices. The larger reserve change may also reflect internal wallet transfers or incomplete address coverage because DeFiLlama tracks exchange-linked wallets. Bitget said attackers exploited flaws in third-party products to obtain internal credentials and submit fraudulent withdrawal instructions, while its private keys and cold-wallet reserves were not compromised. Ethereum withdrawals were scheduled to resume on Sept. 29, USDT on Sept. 30, and remaining tokens, fiat and peer-to-peer services on Oct. 2. The exchange said its Protection Fund would cover customer losses and that it planned to restore the fund to more than $300 million within a week. Investigators said funds were being moved across chains and into mixing services, with Mandiant and SlowMist assisting the tracing effort. Circle and Tether froze $318,013 in USDT and USDC linked to the exploiter. THORChain declined to selectively block attacker addresses, while GoPlus said about 101.5 BTC had moved through the protocol and estimated that another 27.63 million XRP was being converted into Bitcoin. NEAR Intents, a cross-chain asset-swapping protocol, said its SHIELD system blocked more than $50 million in attempted transfers linked to the attack, froze $503,000 during execution and allowed about $166,000 in suspected stolen funds to pass through. NEAR Intents said it would waive Bitget’s bounty offers and return frozen funds through a proper legal process.