Bitget resumes crypto withdrawals after $387.5 million hack

Bitget reopened Bitcoin withdrawals at 08:00 UTC on Monday, September 28, the first phase of a gradual restart after a $387.5 million breach four days earlier. That figure is up from the exchange's first estimate of $351.6 million.

Gracy Chen, CEO of Bitget, set out the timeline in a company notice and in follow-up comments this week. Withdrawals had been frozen since Thursday, September 24, when the exchange caught unauthorized transfers leaving its hot and warm wallets.

What is new since the first report

Bitget told users on September 25 that hackers had taken about $351.6 million. On-chain tracing since then lifted the count to $387.5 million, the company said, once it added transactions on the Zcash and Tron networks. BTC Newz first reported the breach last week.

Chen said the attacker worked in steps. Two tiny test transfers went out first, 0.184 ETH and 193 TRX, at 18:31 UTC on September 24. Both were small enough to pass under the exchange's automatic checks. The main drain followed. Around $361 million left in 17 transactions between 18:58 and 20:09 UTC, spread across eight chains that included Ethereum, XRP, Zcash and Base.

How the attacker got in

According to Chen, the intruders exploited a flaw in a third-party security product, then used stolen internal credentials to push fake withdrawal orders into Bitget's backend systems. Private keys were not cracked. Cold wallets were untouched. The money came out of hot and warm wallets, the pools an exchange keeps online to handle everyday withdrawals.

That detail matters. It points to a break in the plumbing around the wallets rather than the wallets themselves. On that count the case looks like most exchange thefts, which start with stolen access rather than broken cryptography. Chen said the tactics resembled North Korea-linked groups, based on on-chain analysis and IP patterns, while stressing that the investigation is not done. Bitget has brought in Mandiant, a Google Cloud unit, and the security firm SlowMist to trace the funds.

Attribution in crypto thefts is often loose, and an early read on tactics is not proof. Neither Bitget nor its investigators have named a suspect. The exchange has not said how much of the money it expects to freeze or recover.

Who covers the loss

Bitget says users lose nothing. The bill falls on its User Protection Fund, which held 5,500 bitcoin when the attack hit. That pool was worth well above the stolen sum, so it can absorb the loss without touching customer balances, the company said. Trading and deposits kept running through the freeze.

The exchange also opened a recovery bounty. It offers 5 percent of any funds that get frozen or clawed back to people who help track them down. Whether that brings much back is an open question. Cross-border crypto recoveries are slow, and a large share of stolen funds in past exchange hacks was never returned.

What to watch

What remains of the restart runs on a set clock. Ether withdrawals were due to reopen at 08:00 UTC on September 29, Tether on September 30, and everything else, including fiat and peer-to-peer trades, by October 2. The bigger question is behavioral. Do users cash out and walk, or stay once the taps are fully open. The pace of outflows this week will tell that story.

Two other things are worth tracking. One is the forensic report from Mandiant and SlowMist, which should firm up how the breach happened and who was behind it. The other is BGB, Bitget's own token, a rough gauge of how much confidence the market still places in the exchange.