Bitget Restores Withdrawals After $388 Million Security Breach

Bitget has begun restoring cryptocurrency withdrawals after a security breach resulted in approximately $388 million in abnormal asset transfers, according to the exchange.

The phased restoration started on Sept. 28, four days after Bitget identified the security incident. Bitcoin withdrawals through the Bitcoin and BSC networks resumed at 08:00 UTC, while Ethereum withdrawals are scheduled to restart on Sept. 29.

Bitget said the vulnerability behind the attack has been contained and no additional unauthorized transfers have been detected since remediation. User account balances were not affected, while the exchange said its private keys and cold wallets remained secure.

According to Bitget, the attacker exploited a vulnerability in a third-party security product to obtain high-level internal credentials. The compromised credentials were then used to send fraudulent withdrawal instructions to Bitget's wallet system, allowing abnormal transactions to bypass existing risk controls.

The exchange has since strengthened its withdrawal security infrastructure and is reviewing third-party security tools, internal access controls, transaction verification procedures and systems for detecting suspicious activity.

Bitget estimates that roughly $388 million in assets were transferred during the incident based on its latest reconciliation. Mandiant and SlowMist are assisting with the forensic investigation, including identifying the attack vector, confirming remediation measures and tracing stolen assets.

Bitget is also cooperating with law enforcement agencies, blockchain projects, cryptocurrency exchanges and security specialists. Some affected assets have already been frozen, according to the company, while attacker addresses and tracing information have been published to support recovery efforts.

As of 09:00 UTC on Sept. 28, Bitget said it had processed 9,585 BTC withdrawals across the Bitcoin and BSC networks, totaling about 4,098 BTC.

The restoration will continue in stages, with USDT withdrawals scheduled for Sept. 30. Other supported cryptocurrencies, fiat withdrawals and peer-to-peer services are expected to return on Oct. 2.

Bitget, which reports a 127% reserve ratio and a User Protection Fund exceeding $464 million, expects to release an official security report during the week of Sept. 28 after its findings are verified. The exchange said it will continue providing updates on withdrawal services, its investigation and efforts to recover affected assets.