Bitget resumed withdrawals following a security breach on September 24 that resulted in the theft of approximately $388 million from operational wallets. The exchange stated that private keys and cold wallets remained secure, as the attackers exploited a zero-day vulnerability in a third-party application to spoof transactions.
The platform implemented a phased restoration of services: Bitcoin withdrawals resumed on September 28, Ethereum on September 29, and USDT on September 30. Other assets and peer-to-peer transactions are scheduled to return on October 2. Shortly after the Bitcoin window reopened, the exchange processed over 4,098 BTC in withdrawals.
Following the incident, Bitget’s tracked reserves fell to approximately $5.7 billion from a pre-hack balance of over $6.7 billion. Within the first 24 hours of resuming withdrawals, customers moved roughly $463 million off the platform. The total decline in balances, including the theft, reached approximately $600 million.
CEO Gracy Chen confirmed that the exchange will cover all user losses using its User Protection Fund, which held over $464 million prior to the breach. Bitget has engaged cybersecurity firms Mandiant and SlowMist to investigate the incident, with initial assessments pointing toward potential involvement by North Korean-linked hacking groups.
