Bitget Sets Bitcoin Withdrawal Restart After $387.5M Breach

Bitget suspended withdrawals after detecting unauthorized transfers from part of its hot-wallet infrastructure at 18:31 UTC on September 24. The exchange initially estimated losses at $351.6 million, later revising the value transferred to attacker-controlled addresses to approximately $387.5 million, while saying its cold wallets remained secure in a Bitget Support Center notice.

Bitget scheduled a phased return of withdrawal services beginning with Bitcoin at 08:00 UTC on September 28, four days after the incident was detected.

Bitcoin withdrawals restart first on September 28

Bitcoin will be the first asset available for withdrawal under Bitget’s recovery timetable. The exchange said ETH withdrawals are due to follow on September 29, with USDT scheduled for September 30.

The October 2 timetable covers withdrawals for other tokens, fiat withdrawals and P2P services. It restores customer access by asset and service category, rather than through a single reopening of all withdrawal functions.

Bitget published the dates in a September 26 support update, which did not say whether individual withdrawal limits or other conditions would apply as services return. The stated timetable is set out in the exchange’s withdrawal-resumption announcement.

Bitget’s loss estimate rose to $387.5 million without a new breach event

Bitget revised its estimate of funds transferred to attacker-controlled addresses from $351.6 million to approximately $387.5 million after including additional Zcash and TRON transactions, according to its September 25 incident update.

The exchange said the higher figure did not represent further unauthorized transfers. Instead, it was a reassessment of the September 24 incident rather than disclosure of a second breach.

Hot-wallet exposure prompted the withdrawal halt

The disruption was tied to exchange custodial wallets used in Bitget’s hot-wallet infrastructure. Hot wallets are connected to the internet to support operational transfers, unlike cold-wallet storage that is kept separate from online systems.

The Block reported that Bitget’s separate self-custodial Bitget Wallet product was not affected, alongside the exchange’s cold wallets. Trading and deposits remained available during the pause, even as customers could not withdraw assets.

The distinction narrows the incident’s operational scope without changing the significance of the withdrawal suspension for exchange customers. It separates the affected custodial exchange environment from the company’s standalone self-custody product.

Remediation claim and ongoing Mandiant-SlowMist investigation

Bitget said it had identified and remediated the vulnerability behind the incident. The company also said Mandiant and blockchain security firm SlowMist were continuing to support forensic work and efforts to trace the funds.

The remediation statement is Bitget’s own assessment, while the forensic investigation and fund-tracing work remain ongoing. No further findings from Mandiant or SlowMist were detailed in the exchange’s September 26 update.

The next operational milestones are the scheduled restoration dates: Bitcoin withdrawals on September 28, ETH on September 29, USDT on September 30, and the remaining token, fiat and P2P services on October 2.

Disclaimer: This article is provided for informational purposes only. It is not offered or intended to be used as legal, tax, investment, financial, or other advice.