Bitget Restores Withdrawals After $388 Million Security Breach
Bitcoin withdrawals resumed Sept. 28, with Ether, USDT and other services scheduled to return in phases through Oct. 2.
Bitget began restoring withdrawals after attackers transferred approximately $388 million from 12 hot and warm-wallet addresses during a Sept. 24 security breach.
Bitcoin (BTC) withdrawals resumed at 4 a.m. ET (08:00 UTC) Sept. 28. Bitget scheduled Ether (ETH) withdrawals for 4 a.m. ET Sept. 29, USDT withdrawals for 4 a.m. ET Sept. 30, and other tokens, fiat and peer-to-peer services for 4 a.m. ET Oct. 2.
Bitget said 9,585 Bitcoin withdrawals totaling approximately 4,098 BTC had been processed as of 5 a.m. ET Sept. 28. The exchange said the attackers exploited a zero-day vulnerability in a third-party security product, used exposed internal credentials and injected forged withdrawal commands that bypassed risk controls.
Bitget said the breach did not affect its cold-storage systems, private keys or customer balances. Bitget said its Protection Fund holds 5,500 BTC valued at more than $464 million to cover the incident’s financial impact. Mandiant and SlowMist are assisting with the forensic investigation and fund tracing.
Bitget initially estimated the affected assets at $351.6 million before revising the figure to approximately $387.5 million and then approximately $388 million after additional accounting.
