After the Hack: Where Does $387.5M in Stolen Crypto Go?
The Bitget breach is now estimated at roughly $387.5 million, making it one of the largest exchange hacks of the year. Bitget has said its protection fund will keep users whole, and withdrawals were scheduled to resume on September 26. But making users whole doesn't answer the harder question: where does that much stolen crypto actually go?
Here's the playbook investigators are watching, step by step.
1. Stablecoins get dumped first
Attackers don't hold stolen stablecoins for long — and for good reason. Issuers can freeze them. Circle and Tether froze roughly $318,000 in USDC and USDT linked to this hack — but by the time the freezes landed, the attacker had already swapped most of the position. The lesson cuts both ways: freezes work, but only if they're fast.
2. Conversion into ETH
From there, funds typically rotate into ETH — deep liquidity, easy to move across chains, and the native asset of the mixer and bridge ecosystem the launderer needs next.
3. Peeling across wallets, mixers, and bridges
The funds get "peeled": split into smaller amounts and bounced across fresh wallets, mixers, and cross-chain bridges. Each hop breaks the deterministic trail a little further and forces investigators to rely on heuristics — timing, amounts, and behavioral fingerprints — instead of clean address links.
4. OTC off-ramps
Eventually the crypto has to become spendable money. Over-the-counter desks — some legitimate, some not — convert large tranches into fiat or other assets, often across jurisdictions with uneven enforcement.
5. Why it takes so long
Laundering $387.5 million isn't a weekend job. Moving size without moving the market, without tripping exchange compliance, and without leaving an obvious on-chain pattern takes months. Every shortcut — one big swap, one reused address — is a thread investigators can pull.
6. The stablecoin angle
This is the part that matters for the stablecoin beat: issuer freezes make laundering slower and more expensive. The attacker has to dump stablecoins immediately, accept worse prices on fast swaps, and route around the two largest issuers' compliance teams. Centralized stablecoins don't stop theft — but they raise the cost of getting away with it.
Attribution remains unconfirmed; investigators have pointed to a suspected DPRK-linked pattern. We'll update this page as fund movements are confirmed.