Bitget Starts Phased Withdrawal Return After $387.5 Million Security Incident

Highlights:

• Bitget has restarted Bitcoin withdrawals after fixing the security issue behind the September 24 incident.
• Ethereum and USDT withdrawals will resume next, with other tokens and services returning later.
• Bitget says user funds are safe as the investigation and asset recovery efforts continue.

Bitget has started restoring crypto withdrawals after the $387.5 million security incident detected on September 24. Bitcoin withdrawals on the Bitcoin network resumed at 08:00 UTC on September 28 as scheduled. BTC withdrawals through BNB Smart Chain are also open. The exchange said it has fixed the vulnerability linked to the attack. It added that it has found no further unauthorized transfers since containing the incident.

Bitget shared the update on September 28 through its official X account. The exchange said it completed additional security work before restarting withdrawals. According to Bitget, user account balances remain unaffected. Bitget CEO Gracy Chen later updated the withdrawal process. She said the exchange had processed 9,585 Bitcoin withdrawal orders by 17:00 UTC+8. Those withdrawals totaled 4,098.036 BTC.

Bitget has begun the phased resumption of withdrawals following the security incident identified on September 24, with BTC withdrawals on the Bitcoin network started at 08:00 UTC on September 28 as scheduled.

The resumption follows additional security work across Bitget's…

— Bitget (@bitget) September 28, 2026

Bitget Traces Attack to Third-Party Security Product

Bitget said its investigation found that the attacker exploited vulnerabilities in a third-party security product the exchange used. The attacker used the weakness to obtain high-level internal credentials. The attacker then used those credentials to send fraudulent withdrawal commands to Bitget’s wallet system. As a result, the abnormal transfers bypassed the exchange’s risk controls.

However, Bitget said its private keys were not compromised. Its cold wallets were also not affected by the attack. After identifying the attack path, Bitget isolated the affected systems and relevant servers. The exchange also revoked and reissued internal credentials. It also restructured access to highly sensitive systems.

Bitget said it informed the third-party vendor about the vulnerability. It also disabled the affected functionality while it addresses the security issue. Meanwhile, cybersecurity firms Mandiant and SlowMist continue to support the investigation. They are also helping with on-chain tracing efforts. Bitget has published identified attacker addresses and related tracing data to support asset recovery.

Ethereum and USDT Withdrawals Will Resume Next

Bitget is restoring withdrawals in phases rather than reopening all services at once. Ethereum withdrawals are scheduled to resume at 08:00 UTC on September 29. The supported networks include Ethereum, BNB Smart Chain, Arbitrum, Base and Optimism. Next, USDT withdrawals are scheduled to resume on September 30 at 08:00 UTC. They will reopen across Ethereum, BNB Smart Chain, Solana and Tron.

Other token withdrawals are scheduled to return on October 2 at 08:00 UTC. Fiat services and peer-to-peer trading are also expected to resume on the same date. The phased schedule allows Bitget to complete additional security checks while gradually restoring access to its withdrawal services.

Bitget Says User Funds Are Fully Covered

Chen said the Bitget Protection Fund fully covers user funds affected by the incident. According to her, users will not bear losses from the security breach. Bitget also plans to restore the Protection Fund to more than $300 million using its own capital within the week.

Quick recap from tonight's livestream:

1. Withdrawals
BTC live on Bitcoin Mainnet & BSC — 9,585 orders, 4,098.036 BTC processed as of 17:00 UTC+8. ETH, USDT, others follow in phases starting tomorrow.

2. What happened
Full trace-back complete. The attacker exploited… pic.twitter.com/QXTqVu0uDC

— Gracy Chen @Bitget (@GracyBitget) September 28, 2026

Meanwhile, the investigation remains active. Bitget expects to complete an internal security report this week. The exchange said it will share further updates after verifying its findings. Bitget described the September 24 attack as the first security incident of this nature to affect the exchange during its eight years of operation. The company is now focusing on asset recovery, stronger security controls and the full restoration of withdrawal services.