Bitget has started resuming cryptocurrency withdrawals following a security breach on September 24. Bitcoin and BSC network withdrawals resumed on September 28, with Ethereum withdrawals set to reopen on September 29 and USDT withdrawals on September 30. Other supported tokens, fiat services, and peer-to-peer transactions are scheduled to resume on October 2.
The exchange stated that withdrawal restoration is proceeding in phases as part of broader security reviews and infrastructure improvements, with no impact to user account balances.
Attack Details and Response
Bitget identified that attackers exploited a third-party security tool to obtain high-level internal credentials, which were then used to execute unauthorized withdrawals and bypass risk controls. The total assets moved from the exchange were estimated at approximately $388 million.
The company confirmed that private keys were not compromised and cold wallets remained unaffected. Bitget stated the vulnerability has been patched and the incident is contained.
Security firms Mandiant and SlowMist are assisting with forensic investigation. Bitget is coordinating with law enforcement, other exchanges, blockchain projects, and security experts on asset tracing and recovery. Some affected assets have already been frozen through industry coordination efforts.
Withdrawal Progress and Reserves
As of September 28 at 09:00 UTC, Bitget had completed 9,585 Bitcoin withdrawals totaling approximately 4,098 BTC across the Bitcoin and BSC networks.
Bitget reported a comprehensive reserve ratio of 127% and stated its User Protection Fund holds over $464 million. The company noted this marks the first security incident in its 8-year operating history.
Bitget indicated it will release an official security report this week with additional investigation details and information on its response to the incident.
