Crypto exchange Bitget has begun restoring customer withdrawals after a security breach affecting nearly $388 million in assets, even as the attacker continues moving stolen crypto through cross-chain protocol THORChain.

Bitget said on X it resumed Bitcoin (BTC) withdrawals Monday after suspending them following last week's security incident, with additional assets and networks set to follow over the coming days. Exchanges commonly suspend withdrawals during a security investigation to contain potential losses, and restoring them is the main operational step toward returning customer access to funds held on the platform.

The Sept. 24 breach compromised part of Bitget's hot and warm wallet infrastructure, while its cold wallets remained secure, according to the exchange. Hot and warm wallets are internet-connected systems exchanges use to process day-to-day deposits and withdrawals, while cold wallets store private keys offline, away from direct internet access. Bitget later revised the stolen amount from $351.6 million to $387.5 million after accounting for additional transfers on Zcash and Tron.

Ether and USDT withdrawals next as security checks progress

BTC withdrawals on the Bitcoin network and the BNB Smart Chain resumed first, Bitget CEO Gracy Chen said during a Monday ask-me-anything session.

"We restored BTC first because the withdrawal pipeline is the first to be completed," Chen said, adding that Ether (ETH) and Tether's USDt (USDT) would follow as security checks progress.

Related: Bitget clarifies $388M in assets affected by security breach

Under Bitget's announced schedule, ETH withdrawals are set to resume Tuesday across Ethereum, BNB Smart Chain, Arbitrum, Base and Optimism, followed by USDT on Wednesday across Ethereum, BNB Smart Chain, Solana and Tron. Withdrawals for other assets and peer-to-peer services are scheduled to return Friday.

The schedule applies to all users, with no priority access for institutions, VIP customers or Bitget employees, Chen said.

THORChain says network halt cannot selectively freeze funds

Chen has called on THORChain, a decentralized protocol for swapping assets between blockchains, to refuse services to addresses linked to the attack. Cross-chain protocols settle swaps between blockchains that cannot interact natively, with THORChain holding assets in network vaults to cover each side of a trade.

Lookonchain reported Monday that the attacker was swapping Ether for Bitcoin through THORChain, as Arkham data showed ETH linked to the attacker flowing into THORChain vaults.

THORChain said Monday that its network halt is an emergency security mechanism that affects the protocol broadly and "is not a selective freeze of specific funds or an individual swap."

Crypto author Anndy Lian said THORChain can halt trading, stop outbound transactions or pause a connected chain, but those measures affect users broadly. The protocol has no built-in address blacklist, he said, limiting its ability to block specific addresses. That gap between Bitget's request and the protocol's available tools reflects a structural feature of decentralized finance, which runs without the centralized controls that let companies freeze individual addresses.

Bitget's remaining milestones — ETH withdrawals on Tuesday, USDT on Wednesday and other services on Friday — provide the timeline against which the exchange's recovery can be tracked.

Magazine: THORChain under fire over Bitget, ETH evolves beyond blockchain: Hodler's Digest