Cryptocurrency exchange Bitget has initiated a phased restoration of platform withdrawals following a September 24 security incident that resulted in $388 million in unauthorized asset transfers. The resumption began with BTC withdrawals across the Bitcoin and BSC networks at 08:00 UTC on September 28, with additional tokens scheduled for enablements in the coming days.
Exploit Mechanics and Security Response
An internal investigation revealed that the attacker compromised a third-party security product to acquire elevated credentials, which were subsequently used to issue fraudulent withdrawal requests to the exchange's wallet system. Bitget confirmed that private keys were not compromised and cold wallets remained completely untouched. Forensic audit teams from Mandiant and SlowMist are conducting independent investigations to trace assets and evaluate security controls alongside law enforcement agencies.
Following the initial breach where attackers drained platform assets, Bitget CEO Gracy Chen held an AMA on September 28 to outline recovery steps. As of 09:00 UTC on September 28, 9,585 users had submitted withdrawal requests totaling 4,098 BTC. Platform metrics show a Proof of Reserves ratio of 127% and a User Protection Fund valued at over $464 million.
Key Takeaways
- Bitcoin Resumed: BTC withdrawals on Bitcoin and BSC went live at 08:00 UTC on September 28, processing 4,098 BTC across 9,585 users within the first hour.
- Phased Rollout: ETH withdrawals resume on September 29 at 08:00 UTC, followed by USDT on September 30 at 08:00 UTC, and all remaining tokens, fiat, and P2P services on October 2 at 08:00 UTC.
- Loss Coverage: The exchange reports $388 million in total transferred assets, backed by a $464 million User Protection Fund and 127% Proof of Reserves.
- Attacker Vector: Vulnerabilities in third-party software allowed unauthorized internal credential access, bypassing risk controls without exposing cold wallet private keys.
Timeline for Full Operational Recovery
The exchange has scheduled ETH withdrawals across Ethereum, BSC, Arbitrum, Base, and Optimism for 08:00 UTC on September 29. USDT functionality across Ethereum, BSC, Solana, and Tron will resume at 08:00 UTC on September 30, while fiat, P2P services, and remaining altcoins are slated to re-open on October 2 at 08:00 UTC. To retain activity, Bitget launched the Bitget Alliance Program running from September 28 to October 26 for transaction fee sharing, alongside Project Stand Together offering fee discounts for institutional PRO clients through October 30 and protection through November 30. An official forensic security report detailing full findings will be released later this week.
Why It Matters
The ability of a major exchange to survive a $388 million exploit without insolvency highlights the critical role of capital buffers such as Bitget's $464 million User Protection Fund. However, the reliance on third-party security vendors exposes a systemic risk across centralized crypto infrastructure where credentials can be compromised above the wallet layer. As withdrawals reopen, monitoring potential user outflows will determine whether institutional market makers and retail traders retain long-term trust in the platform.
