Bitget Reopens BTC Withdrawals After $388 Million Exploit

Bitget began restoring withdrawals on Monday, starting with bitcoin, four days after an exploit drained about $388 million from the exchange’s hot and warm wallets.

A staggered return

BTC withdrawals opened at 8:00 a.m. UTC on Sept. 28, with each chain required to clear a round of security checks before it comes back online.

ETH withdrawals on Ethereum, BSC, Arbitrum, Base and Optimism are scheduled to follow on Sept. 29, with USDT on Ethereum, BSC, Solana and Tron returning on Sept. 30.

All remaining tokens, fiat withdrawals and P2P transactions are set to come back on Oct. 2.

Bitget said the rollout applies to every user equally, and that trading and deposits have kept running throughout.

How the attack happened

The unauthorized transfers began around 6:31 p.m. UTC on Sept. 24, after the attacker exploited a flaw in a third-party security product to obtain high-level internal credentials.

The exchange described what followed in a statement:

“The attacker then used these credentials to send fraudulent withdrawal commands to the wallet system, causing it to execute abnormal transfers that bypassed risk controls.”

Bitget said its private keys, cold wallets and user balances were not compromised, and that the vulnerability has since been patched.