Bitget Resumes BTC Withdrawals After $388 Million Incident

Bitget moved its first Bitcoin withdrawals back online at 08:00 UTC on Sept. 28, four days after an attacker used what CEO Gracy Chen described as “high-level internal credentials” to push fraudulent withdrawal commands through the exchange’s wallet system. By 09:00 UTC, users had initiated 9,585 BTC withdrawals totaling 4,098.03574 BTC, and the exchange reported the service was running normally, according to U.today.

Chen laid out the sequence of events during a public livestream on X, saying the attacker exploited a vulnerability in a third-party security product to reach internal credentials, then used those credentials to inject withdrawal instructions into wallet-related backend services. She said the commands triggered abnormal transfers that bypassed existing risk controls, and that the attacker disguised the activity as routine administrative operations while deleting traces of it.

Key facts

• The first unauthorized transfers began around 18:31 UTC on Sept. 24, with 0.84 ETH moved from an Ethereum hot wallet and 93 TRX from a Tron hot wallet — both below Bitget’s risk-control threshold, so neither triggered an alert.
• Between 18:58 and 20:09 UTC, the attacker initiated 17 larger transfers across Ethereum, XRP, Zcash, BNB Smart Chain, Base, Arbitrum, Optimism and Avalanche, with a combined estimated value of about $361 million.
• A second wave of seven transfers between 20:55 and 21:23 UTC, involving Avalanche, XRP, Ethereum, Zcash, Algorand, TIA and Cosmos, was estimated at roughly $30 million.
• crypto.news reported that the publicly cited loss figure rose from Bitget’s initial estimate of about $351.6 million to approximately $387.5 million, a later figure that included Zcash and TRON assets absent from the first tally.
• Bitget’s User Protection Fund exceeds $464 million, and the exchange reported a comprehensive Proof of Reserves ratio of 127%.

How the exchange responded, hour by hour

Bitget’s monitoring systems spotted a significant discrepancy at 19:05 UTC, seven minutes after the first large transfer, and the platform automatically blocked user-initiated withdrawals. The exchange activated a P0 emergency response at 19:14 UTC, began containment at 19:40 UTC, and at about 20:40 UTC the wallet team started moving funds into cold storage as a precaution while it assessed whether private keys had been compromised.

At approximately 21:44 UTC, Bitget shut down wallet withdrawal services, including its signing service, and isolated withdrawal-related inbound and outbound access. Chen said this was the first security event of its kind to hit Bitget Exchange in eight years of operation, and that the exchange does not currently believe the incident was an inside job — adding that it would not speculate about the attacker’s identity before the investigation reaches a confirmed conclusion.

The recovery schedule runs in stages. ETH withdrawals are due at 08:00 UTC on Sept. 29 across Ethereum, BNB Smart Chain, Arbitrum, Base and Optimism, while USDT is set for 08:00 UTC on Sept. 30 across Ethereum, BNB Smart Chain, Solana and Tron, per crypto.news. Other tokens, fiat services and P2P transactions are scheduled for 08:00 UTC on Oct. 2. Chen said BTC went first because its withdrawal pipeline had cleared the necessary security checks and the Bitcoin network itself was untouched by the incident.

The two outlets diverge on the headline number. U.today reports approximately $388 million in assets transferred, described by Bitget as its latest reconciliation and classification of attack-related transactions. crypto.news reports the value transferred to attacker-controlled addresses at approximately $387.5 million, noting the exchange’s tracing work is ongoing and the figure may shift as investigators classify additional transactions. Bitget has also said its cold wallets were secure and that its investigation found no evidence of a private-key leak.

Why it matters

Bitget’s incident is a reminder that exchange breaches increasingly arrive through third-party software and legitimate-looking credentials rather than a broken private key, which shifts the security burden onto vendor vetting and internal access controls that customers never see. The disclosure schedule also matters to anyone holding funds on a centralized venue: a full withdrawal pause is being lifted asset by asset and network by network, so a token’s scheduled return date does not guarantee that every chain it runs on reopens at the same time. Bitget has said account balances were unaffected and that losses will be absorbed by its User Protection Fund, which Chen said the exchange established in 2022 and would replenish with company capital to more than $300 million in USDT or equivalent within a week of use. She framed the pause as “just a security measure” unrelated to the sufficiency of user assets, because those assets are fully recovered or fully covered by the fund.

What to watch

Bitget expects to publish its official security report this week and has said further findings will be disclosed as they are verified. In the meantime, the next operational milestones are the ETH reopening on Sept. 29 and USDT on Sept. 30, with availability shown directly on the platform.

Sources: U.Today, crypto.news