Nearly 5,000 Bitcoin has left Bitget’s tracked reserves after the crypto exchange reopened withdrawals following its $387.5 million hack.

On Sept. 28, Bitget Chief Executive Officer Gracy Chen said the exchange had processed 9,585 withdrawal orders totaling 4,098.036 BTC as of 17:00 UTC+8, shortly after it resumed Bitcoin withdrawals.

Separate DeFiLlama data showed Bitget’s tracked Bitcoin balance falling to about 30,770 BTC from 35,412 BTC, a decline of roughly 4,642 BTC. At prevailing prices, the drop represents about $391 million of Bitcoin.

The reserve decline is larger than the amount Chen said Bitget had processed through customer withdrawal orders. DeFiLlama tracks assets held in wallets attributed to exchanges, meaning changes can also reflect wallet movements or differences in address coverage rather than customer withdrawals alone.

Still, the rapid outflow provides the first indication of how users are responding after Bitget froze withdrawals for four days while investigating the largest security incident in its eight-year history.

Bitget restored Bitcoin withdrawals at 08:00 UTC on Sept. 28 after completing additional checks on its withdrawal infrastructure. Ethereum withdrawals are scheduled to follow on Sept. 29, USDT on Sept. 30, and remaining tokens, fiat, and peer-to-peer services on Oct. 2.

The restart comes as Bitget attempts to reassure customers that the attack did not compromise its private keys or cold-wallet reserves.

Chen said a completed internal trace found that attackers exploited vulnerabilities in third-party products to obtain internal credentials. Those credentials were then used to submit fraudulent withdrawal instructions that bypassed Bitget’s risk controls.