Bitget restores bitcoin withdrawals after $388 million breach

Bitget has reopened bitcoin withdrawals after a security breach moved about $388 million from the centralized exchange’s hot and warm wallets. The reopening began at 08:00 UTC on September 28, four days after the incident, and gives customers their first live test of Bitget’s repaired withdrawal controls.

The exchange’s incident page said 9,585 withdrawal requests totaling approximately 4,098 BTC had been processed by 09:00 UTC on September 28. Those are Bitget’s operational figures, not an independent audit of successful customer receipt, reserve sufficiency or the safety of every supported chain.

A phased reopening, not a full restoration

Bitget scheduled ether withdrawals on Ethereum, BNB Smart Chain, Arbitrum, Base and Optimism for 08:00 UTC on September 29. USDT withdrawals on Ethereum, BNB Smart Chain, Solana and Tron are scheduled for the same time on September 30, while other tokens, fiat withdrawals and peer-to-peer services are due back at 08:00 UTC on October 2.

The company’s live incident page was internally inconsistent when reviewed Tuesday morning: its FAQ said BTC and ETH withdrawals had resumed, while the status table still marked the September 29 ETH phase as pending. Coinburn therefore treats bitcoin as the verified reopened asset and the remaining timetable as scheduled until Bitget’s chain-specific notices and user transactions confirm each stage.

That distinction matters because deposits and trading remained available while withdrawals were suspended. Customers could see balances and trade inside the venue, but could not necessarily move assets into self-custody or another exchange. Reopening one withdrawal rail reduces that constraint; it does not establish that the full platform has returned to normal.

What the records show about the breach

Bitget says it detected unauthorized transfers at 18:31 UTC on September 24. Its current account attributes the breach to a zero-day flaw in a third-party security product that exposed high-privilege internal credentials. The company says forged withdrawal instructions then passed through its wallet system, while private keys and cold wallets were not compromised. Mandiant and SlowMist are assisting, but Bitget had not published a completed independent forensic report by the publication cutoff.

Independent on-chain work by Bitquery supports the broad conclusion that Bitget-controlled wallets paid attacker addresses across multiple networks, but it also highlights unresolved details. Bitquery traced 21 transfers across eight chains and valued them at $357.36 million using asset prices in the hour of each transfer. Bitget’s later estimate is $387.5 million after adding Zcash and Tron assets; the totals are not directly interchangeable because the datasets and valuation methods differ.

Bitquery also calculated that transfers continued for two hours and 18 minutes after 19:05 UTC, the time Bitget’s chief executive said monitoring detected the theft and customer withdrawals were blocked. Blockchain records can establish transaction timing and wallet movement, but they cannot independently prove how Bitget’s internal systems were compromised.

The remaining test

Bitget says a protection fund holding 5,500 BTC, valued by the company at more than $464 million at its incident-page snapshot, will absorb the loss without reducing customer account balances. That comparison is issuer-supplied, changes with bitcoin’s price and does not substitute for audited liabilities, custody verification or proof that all customer withdrawals can be honored under stress.

The next verifiable milestones are completion of the staged withdrawal schedule, publication of the promised forensic report and disclosure of recoveries. Until then, the evidence supports a partial service restoration after a major breach—not a completed recovery or an independently proven solvency claim.