Bitget has begun restoring withdrawals after the September 24 security incident, starting with BTC on September 28.
The exchange has identified the attack path, remediated the vulnerability and confirmed that user balances remain unaffected, with a full security report expected this week.
Phased withdrawal resumption begins
BTC withdrawals on the Bitcoin and BSC networks resumed at 08:00 UTC on September 28, as scheduled. The resumption follows additional security work across Bitget’s withdrawal infrastructure.
Earlier the same day, Bitget CEO Gracy Chen addressed the incident, the withdrawal process and next steps during a live AMA.
Eight years of security and what comes next
The September 24 incident is the first security incident of this nature affecting Bitget Exchange in eight years of operation. The vulnerability has been remediated, and no further unauthorized transfers have been identified since containment.
The security environment around digital assets has changed significantly over that period. Attacks have become more sophisticated, infrastructure more interconnected, and the consequences of a security failure more serious.
Bitget’s security framework has evolved alongside those risks. Over the past eight years, the company has strengthened its wallet infrastructure and risk controls, introduced monthly Proof of Reserves and established a dedicated User Protection Fund.
Bitget currently reports a comprehensive Proof of Reserves ratio of 127%, while the User Protection Fund stands at more than $464 million.
That record does not diminish the seriousness of the incident. It sets the standard against which Bitget’s response should now be measured.
How the attack happened
The investigation found that the attacker exploited a vulnerability in a third-party security product to obtain high-level internal credentials. These credentials were used to send fraudulent withdrawal commands to the wallet system.
The resulting abnormal transfers bypassed risk controls. Private keys were not compromised, and cold wallets were not affected.
Bitget recognizes that the security of third-party systems integrated into its infrastructure forms part of its own security responsibility. Following the incident, the company has introduced stricter assessment criteria for third-party products, stronger controls around their deployment and independent verification for withdrawals.
It is also strengthening internal access controls, withdrawal verification and abnormal activity monitoring across the platform.
Investigation and recovery
Bitget has confirmed that approximately $388 million in assets were transferred out during the incident. The figure reflects the latest reconciliation and classification of transactions associated with this incident.
Mandiant and SlowMist continue to support the independent forensic investigation. Their work covers the attack vectors and methods used, validation of containment and remediation measures, and asset tracing.
Bitget is also working with law enforcement, exchanges, blockchain projects, on-chain security specialists and other industry partners on tracing and recovery. Some affected assets have already been frozen, and Bitget has published identified attacker addresses and relevant tracing data.
Bitget expects to complete an official security report this week. Detailed findings will be disclosed through that report, with further material developments shared as they are verified.
Withdrawal schedule
ETH withdrawals across Ethereum, BSC, Arbitrum, Base and Optimism are scheduled to resume on September 29 at 08:00 UTC. USDT withdrawals across Ethereum, BSC, Solana and Tron follow on September 30 at 08:00 UTC.
Other supported tokens, fiat and P2P services are set to resume on October 2 at 08:00 UTC. Withdrawal availability will continue to be reflected directly on the Bitget platform.
As of 09:00 UTC on September 28, 9,585 users had initiated withdrawals, totalling approximately 4,098 BTC since resumption. Withdrawal status is currently normal.
User and institutional programs
Alongside the withdrawal resumption, Bitget is introducing two limited-time programs for eligible users and professional clients.
The Bitget Alliance Program allows eligible users to share in transaction fees generated through trading activity on the platform. It runs from September 28 at 08:00 UTC to October 26 at 08:00 UTC. Full details are available here.
Project Stand Together offers eligible PRO clients and market makers special fee discounts and extended PRO level protection. Preferential rates run from September 28 at 10:00 UTC to October 30 at 09:00 UTC, while PRO level protection runs through November 30 at 09:00 UTC. Full details are available here.
Bitget will continue providing updates as the investigation, withdrawal resumption and asset recovery progress.