Bitget starts phased withdrawal resumption following $388 million exploit

Bitget has begun restoring customer withdrawals in stages following an exploit that drained roughly $388 million from the exchange on Sept. 24. The exchange said BTC withdrawals on the Bitcoin and BSC networks reopened at 8 a.m. UTC on Monday, as previously scheduled.

Further stages follow a fixed timetable. ETH withdrawals on Ethereum, BSC, Arbitrum, Base and Optimism are set to resume on Sept. 29 at 8 a.m. UTC. USDT withdrawals on Ethereum, BSC, Solana and Tron are scheduled for the same time the following day, while all remaining assets, fiat withdrawals and P2P transactions are expected to return on Oct. 2. Bitget said each chain must clear a series of security checks before payouts can be re-enabled, which is why the process is being carried out in phases.

How the attack unfolded

According to the exchange, unauthorized transfers involving certain assets took place across multiple networks from its hot and warm wallet infrastructure at around 6:31 p.m. UTC on Sept. 24. Bitget said the attacker exploited a vulnerability in a third-party security product to obtain high-level internal credentials, then used them to issue fraudulent withdrawal commands that bypassed risk controls. The Block previously reported that ether, USDT, USDC, AVAX and BNB were among the assets moved.

Bitget said its private keys were not compromised and that user balances and cold wallets were unaffected. The exchange said it has patched the vulnerability and contained the incident, with no further unauthorized transfers recorded. Mandiant and SlowMist are assisting the investigation, and Bitget expects to publish an official security report this week.

The $388 million loss is the largest reported crypto theft so far this year, exceeding exploits at KelpDAO and Drift Protocol. Bitget said the losses will be fully covered by its User Protection Fund, which holds 5,500 BTC. The exchange has also launched a bounty program paying 5% of any attacker funds that are frozen or recovered, and said some affected assets have already been frozen through coordination with industry partners, without disclosing the amount. While Bitget declined to speculate on the attackers' identity, it described them as sophisticated and state-backed, and has previously said it suspects North Korea.