Bitget resumes withdrawals in phases after $388 million crypto exploit

Traders Union
All News
Crypto
Bitget resumes withdrawals after exploit

Highlights

Bitget resumes BTC withdrawals on Sept. 25, phased asset withdrawal restoration through Oct. 2 following a $388 million exploit involving multiple networks.
Stolen assets totaling $388 million will be fully reimbursed by Bitget's User Protection Fund, which holds 5,500 BTC, with user balances and cold wallets unaffected.
Bitget patches the exploited third-party vulnerability, with Mandiant and SlowMist aiding the ongoing investigation, and offers a 5% bounty on successfully frozen stolen funds.

Withdrawal restart and security timeline

As reported by The Block, Bitget says BTC withdrawals on the Bitcoin network start processing at 8 a.m. UTC on Monday, with each blockchain required to clear security checks before services are restored.

The exchange says ETH withdrawals on Ethereum, BSC, Arbitrum, Base and Optimism are due to reopen on Sept. 29 at 8 a.m. UTC. USDT withdrawals on Ethereum, BSC, Solana and Tron are scheduled to resume at the same time the following day, while all remaining assets, fiat withdrawals and P2P transactions are set to be restored on Oct. 2.

Bitget says the exploit involved unauthorized transfers of certain assets across multiple networks from its hot and warm wallet infrastructure. The company says an attacker exploited a vulnerability in a third-party security product to obtain high-level internal credentials, then used those credentials to issue fraudulent withdrawal commands that bypassed risk controls.

Loss coverage and wider crypto impact

Bitget says its private keys were not compromised and that user balances and cold wallets were not affected. The exchange adds that it has patched the vulnerability, contained the incident and seen no further unauthorized transfers, while Mandiant and SlowMist are assisting the investigation.

The company confirms stolen assets totaled about $388 million, making the incident the largest reported crypto theft of the year, ahead of exploits involving KelpDAO and Drift Protocol. Bitget says the full loss will be covered by its User Protection Fund, which it says holds 5,500 BTC.

Bitget has also launched a bounty program offering 5% of any amount successfully frozen to parties whose actions directly lead to attacker funds being recovered or blocked. While the exchange says it will not identify the attackers before the investigation reaches a firm conclusion, it describes them as sophisticated and state-backed, and it has previously said it suspects North Korea was behind the attack.

Our earlier coverage on the Enforcement Directorate’s asset attachment in the Gameskraft-linked RummyCulture case explained how investigators provisionally attached ₹442.35 crore under the PMLA amid allegations tied to real-money gaming operations. The report also outlined claims about revenue through platform commissions, suspected bot use and user acquisition tactics, and the alleged layering of proceeds into financial instruments and high-value properties as the overall tally of attached/frozen/seized assets rose to ₹2,843 crore.

This material may contain third-party opinions, none of the data and information on this webpage constitutes investment advice according to our Disclaimer. While we adhere to strict Editorial Integrity, this post may contain references to products from our partners.