Bitget resumes Bitcoin withdrawals after $387.5M malicious transfers

The cryptocurrency exchange Bitget has resumed Bitcoin withdrawals four days after unauthorized transfers totaling approximately $387.5 million were made from its hot and warm wallet infrastructure, according to Infosecurity Magazine. Withdrawals on the Bitcoin network reopened at 8 a.m. UTC on September 28 following additional security checks.

The incident, detected on September 24, was traced to a flaw in a third-party security product that granted the attacker high-level internal credentials. These were used to bypass risk controls and initiate fraudulent withdrawal commands. Bitget initially estimated the affected amount at $351.6 million, later revising it to $387.5 million after identifying additional affected Zcash and TRON transfers. The exchange confirmed that its cold wallets remained unaffected and user account balances were intact.

Trading and deposits continued during the withdrawal suspension. Bitget stated the loss is covered by its Protection Fund, valued at over $464 million. The exchange is working with law enforcement and blockchain security firms, including Mandiant and SlowMist, to trace and recover assets, some of which have been frozen. Bitget plans to gradually restore other withdrawals, including Ether and Tether, in the coming days and will review its assessment of third-party security products.

Source: