Bitget Restores BTC Withdrawals Four Days After $388M Exploit Of Third-Party Security Tool
In Brief
Bitget resumes BTC withdrawals after a $388M security breach linked to a third-party vulnerability. ETH, USDT and other services to follow as Mandiant and SlowMist investigate.
Cryptocurrency exchange Bitget announced that it has begun a phased resumption of withdrawals following the security incident first identified on September 24, with Bitcoin withdrawals reopening at 08:00 UTC on September 28 across the Bitcoin and BSC networks. In an official statement, platform’s CEO Gracy Chen confirmed that approximately $388 million in assets were transferred out during the incident, while stressing that user account balances remain unaffected.
According to Bitget, the attacker exploited a vulnerability in a third-party security product integrated into Bitget’s infrastructure to obtain high-level internal credentials. Those credentials were then used to issue fraudulent withdrawal commands to the wallet system, producing abnormal transfers that bypassed existing risk controls. Private keys were not compromised, and cold wallets were not affected.
The incident is the first security breach of this nature to hit Bitget Exchange in eight years of operation. Beginning at approximately 18:31 UTC on September 24, unauthorized transfers involving certain assets were made across multiple blockchains from portions of the exchange’s hot and warm wallet infrastructure. The affected systems were isolated, the vulnerability remediated, and no further unauthorized transfers have been identified following containment. Bitget has since strengthened controls across its withdrawal infrastructure, including stricter assessment criteria and deployment controls for third-party products, stronger internal access controls, independent verification for withdrawals, and improved detection of abnormal activity.
The $388 million figure reflects the latest reconciliation and classification of transactions tied to the incident and does not represent additional losses following containment. Bitget reports a comprehensive Proof of Reserves ratio of 127%, and its dedicated User Protection Fund currently stands at more than $464 million.
Phased Withdrawal Schedule and Recovery Efforts
Under the current schedule, ETH withdrawals will resume on September 29 across Ethereum, BSC, Arbitrum, Base, and Optimism; USDT withdrawals follow on September 30 across Ethereum, BSC, Solana, and Tron; and other supported tokens, fiat, and P2P services are set to reopen on October 2. Withdrawal availability is being reflected directly on the platform. As of 09:00 UTC on September 28, the exchange had processed withdrawals totaling 4,098.03574 BTC from 9,585 users, with operations reported as normal.
On the investigative side, cybersecurity firms Mandiant and SlowMist continue to support the independent forensic review, examining attack vectors, validating containment and remediation measures, and assisting with on-chain tracing. Bitget is also coordinating with law enforcement, exchanges, blockchain projects, and on-chain security specialists; some affected assets have already been frozen through industry collaboration, and the exchange has published identified attacker addresses and tracing data to support recovery efforts. An official security report is expected to be completed this week.
Alongside the withdrawal resumption, Bitget has introduced two limited-time programs: the Bitget Alliance Program, allowing eligible users to share in transaction fees generated through platform trading activity, and Project Stand Together, offering temporary fee discounts and extended PRO-level protection to eligible professional clients and market makers.
Disclaimer
In line with the Trust Project guidelines, please note that the information provided on this page is not intended to be and should not be interpreted as legal, tax, investment, financial, or any other form of advice. It is important to only invest what you can afford to lose and to seek independent financial advice if you have any doubts. For further information, we suggest referring to the terms and conditions as well as the help and support pages provided by the issuer or advertiser. MetaversePost is committed to accurate, unbiased reporting, but market conditions are subject to change without notice.
About The Author
Alisa, a dedicated journalist at the MPost, specializes in crypto, AI, investments, and the expansive realm of Web3. With a keen eye for emerging trends and technologies, she delivers comprehensive coverage to inform and engage readers in the ever-evolving landscape of digital finance.
More articles
Alisa, a dedicated journalist at the MPost, specializes in crypto, AI, investments, and the expansive realm of Web3. With a keen eye for emerging trends and technologies, she delivers comprehensive coverage to inform and engage readers in the ever-evolving landscape of digital finance.
