Bitget sets withdrawal timetable after $350 million to $387.5 million hack

Bitget has published a phased withdrawal restart after a security breach that led to the unauthorized transfer of between $350 million and $387.5 million from its hot and warm wallets. For high-risk operators, the useful part is not the headline number alone: Bitget says user balances were unaffected, trading and deposits stayed live, and withdrawals are being brought back network by network.

1. The breach was detected at 18:31 UTC on September 24, when Bitget’s security systems flagged unusual outflows. The exchange says the incident has been contained and the vulnerability that enabled it has been fixed.
2. Investigators found that attackers gained access to a critical backend component in the exchange’s wallet infrastructure and used spoofed transaction data to trigger legitimate authorization processes. Bitget said private keys were not compromised and its cold wallet reserves remained secure throughout the incident.
3. Bitget said user balances remain unaffected and are backed by its User Protection Fund, which holds more than $464 million in publicly verifiable assets. The stolen assets included XRP, Ethereum (ETH), USDT, USDC, and other cryptocurrencies, with losses later revised higher after additional Zcash and Tron-related transfers were identified.
4. Withdrawals are being restored in phases. Bitcoin withdrawals on the Bitcoin network are scheduled to resume at 08:00 UTC on September 28. Withdrawals on Ethereum and Ethereum-based networks, including BNB Smart Chain, Arbitrum, Base, and Optimism, are expected to reopen at the same time on September 29.
5. USDT withdrawals across Ethereum, BNB Smart Chain, Solana, and Tron are set to resume on September 30. All remaining token withdrawals, fiat services, and peer-to-peer functions are planned to return on October 2, with Bitget saying the staggered rollout is needed to validate withdrawal infrastructure across multiple blockchain networks before full restoration.

Bitget said the attack patterns, including IP and behavioral indicators, closely resemble activity previously associated with North Korean hacking groups. The exchange is working with Mandiant and SlowMist, law enforcement agencies, and blockchain ecosystem partners, and has launched a recovery bounty program.