Bitget has initiated a phased restoration of withdrawal services following a security breach on September 24. The exchange resumed BTC withdrawals on the Bitcoin and BSC networks on September 28 at 08:00 UTC. The company confirmed that approximately $388 million in assets were transferred during the incident, though user balances remain unaffected.
The investigation revealed that an attacker exploited a vulnerability in a third-party security product to gain internal credentials and bypass risk controls. Bitget stated that private keys and cold wallets were not compromised. The firm is currently working with Mandiant, SlowMist, and law enforcement to trace assets and has already frozen some of the stolen funds.
The platform has implemented stricter assessment criteria for third-party integrations and enhanced internal access controls. A full security report is expected to be released this week. Bitget maintains a Proof of Reserves ratio of 127% and a User Protection Fund valued at over $464 million.
Withdrawals for ETH are scheduled to resume on September 29, followed by USDT on September 30. Other tokens, fiat, and P2P services are set to return on October 2. As of 09:00 UTC on September 28, 9,585 users had successfully withdrawn approximately 4,098 BTC.
To support users and institutional clients, Bitget launched two temporary programs. The Bitget Alliance Program runs until October 26, allowing users to share in transaction fees. The Project Stand Together initiative provides fee discounts and extended protection for professional clients and market makers through November 30.
