Bitget Resumes Crypto Withdrawals After $388M Security Breach

Bitget has begun restoring cryptocurrency withdrawals following a September 24 security incident that resulted in approximately $388 million in assets being transferred from the exchange.

The crypto exchange resumed Bitcoin withdrawals across the BTC and BSC networks on September 28. Bitget said services are being restored gradually as it completes security reviews and upgrades to its withdrawal infrastructure. User account balances were not affected by the incident, according to the company.

Bitget's investigation found that the attacker exploited a vulnerability in a third-party security product to obtain high-level internal credentials. The compromised credentials were then used to submit fraudulent withdrawal commands, allowing abnormal transfers to bypass existing risk controls.

Bitget stressed that private keys were not compromised and its cold wallets remained unaffected. The vulnerability has since been patched, and the exchange said no additional unauthorized transfers have been detected following containment.

The company estimates that roughly $388 million in assets were moved during the attack based on its latest transaction reconciliation. Mandiant and SlowMist are assisting with the forensic investigation, while Bitget is working with law enforcement agencies, exchanges, blockchain projects and security specialists to trace and recover the assets. Some affected funds have already been frozen through industry coordination.

Bitget plans to resume ETH withdrawals on September 29, followed by USDT withdrawals on September 30. Withdrawals for other supported cryptocurrencies, along with fiat and peer-to-peer services, are expected to return on October 2.

As of 09:00 UTC on September 28, Bitget had processed 9,585 BTC withdrawals totaling approximately 4,098 BTC across the Bitcoin and BSC networks.

Bitget described the breach as the first major security incident in its eight-year history. The exchange reported a comprehensive reserve ratio of 127%, while its User Protection Fund holds more than $464 million.

An official security report is expected this week, providing further details about the investigation, asset recovery efforts and measures being implemented following the Bitget hack.