Bitget Resumes BTC Withdrawals After Security Incident Involving Approximately $388 Million
Crypto exchange Bitget has resumed Bitcoin withdrawals following an incident involving its hot and warm wallet infrastructure. Further withdrawals are expected to resume gradually by October 2.
Bitget BTC withdrawals resumed on September 28 at 08:00 UTC after a security incident in which unauthorized transfers occurred on September 24 from part of the exchange’s hot and warm wallet infrastructure. The Bitcoin and BSC networks are open for Bitcoin withdrawals.
The exchange initially stated that approximately $387.5 million in cryptocurrencies had been transferred to addresses controlled by the attacker. In a newer summary, it rounds the incident’s scope to approximately $388 million. Withdrawals were temporarily suspended after the incident and are expected to resume in stages.
Bitget BTC withdrawals are the first service to resume
The resumption of BTC withdrawals is the first confirmed step toward returning services to normal operations. According to Bitget’s schedule, ETH withdrawals are expected to follow on September 29 and USDT withdrawals on September 30. The exchange is expected to make additional assets, fiat services, and P2P available on October 2.
Bitget states that it removed the vulnerability, isolated the affected systems, and recorded no further unauthorized transfers after containing the incident. The forensic investigation and tracking of transferred assets are continuing with the involvement of Mandiant and SlowMist.
The cause of the incident remains preliminary
According to the exchange, the incident may have involved exploitation of a vulnerability in a third-party product that allowed the attacker to obtain internal permissions. This version remains preliminary, and the final forensic findings have not been published.
Bitget also has not definitively attributed the attack to a specific group. It does not consider speculation about possible involvement by North Korean actors confirmed and states that it will wait until the investigation is completed before making an attribution.
The exchange claims that user balances were not affected by the incident and that its Protection Fund covers the damage. These claims have not been independently verified. It is likewise unconfirmed what portion of the stolen assets was frozen or recovered.
What to watch next
The next test of the operational recovery will be meeting the deadlines for ETH, USDT, and the other services. The results of the forensic investigation will also be important, particularly confirmation of the attack’s entry point, identification of the affected third-party product, and clarification of the financial scope of the damage. The fate of the transferred assets also remains an open question.
Sources
- Bitget – Security Incident: Timeline, Impact and Response – Confirms the time of the incident, the start of BTC withdrawals on September 28 at 08:00 UTC, the status of the investigation, the preliminary attack mechanism, and the schedule for further withdrawals.
- Bitget Support Center – Security Latest Incident Update – Confirms the estimate of $387.5 million transferred to addresses controlled by the attacker and the ongoing investigation with Mandiant and SlowMist.
- BleepingComputer – Independently reports on the resumption of BTC withdrawals and the phased schedule for additional services.
Verified and updated: September 28, 2026 15:23
