Bitget has begun a phased resumption of withdrawals following a security incident on September 24 that resulted in the loss of approximately $388 million. Bitcoin withdrawals on the Bitcoin network reopened at 08:00 UTC on September 28 as scheduled.
The exchange said it has remediated the vulnerability responsible for the breach and identified no further unauthorized transfers since the incident was contained. User account balances remain unaffected, and Bitget confirmed that its User Protection Fund, which holds 5,500 BTC, will cover all losses from the incident.
Phased Withdrawal Schedule
Bitget is restoring withdrawal services in stages, with each blockchain undergoing additional security checks before reopening. The exchange outlined the following timeline:
- Bitcoin (BTC) withdrawals: September 28 at 08:00 UTC
- Ethereum (ETH) withdrawals on Ethereum, BSC, Arbitrum, Base, and Optimism: September 29 at 08:00 UTC
- USDT withdrawals on Ethereum, BSC, Solana, and Tron: September 30 at 08:00 UTC
- All remaining assets, fiat withdrawals, and peer-to-peer transactions: October 2
According to the exchange, full withdrawal services will be restored within four steps.
Details of the Security Breach
Unauthorized transfers began at approximately 6:31 p.m. UTC on September 24, affecting certain assets across multiple networks originating from Bitget's hot and warm wallet infrastructure. The attacker exploited a vulnerability in a third-party security product to obtain high-level internal credentials, then sent fraudulent withdrawal commands to the wallet system that bypassed risk controls.
Bitget stated that its private keys were not compromised, and cold wallets and user balances were unaffected. The $388 million loss represents the largest reported cryptocurrency theft of the year, exceeding previous exploits on KelpDAO and Drift Protocol.
Investigation and Recovery Efforts
Mandiant and SlowMist are assisting with investigation into the incident. Bitget has launched a bounty offering 5 percent of any attacker funds frozen or recovered. The exchange said it will not speculate about the attackers' identity until the investigation reaches a firm conclusion, though it described them as sophisticated and stated it suspects state-backed involvement.
Bitget also announced plans to review its processes for assessing and deploying third-party security products.
