Crypto exchange Bitget initiated a phased resumption of user withdrawals on Sept. 28, following a security incident on Sept. 24 that drained approximately $388 million in assets. Bitcoin withdrawals reopened first, with other digital assets to follow over the coming days.
The withdrawal process is staggered by blockchain network. Bitcoin withdrawals on the Bitcoin network began at 08:00 UTC on Sept. 28. Ether withdrawals across Ethereum, BNB Smart Chain, Arbitrum, Base and Optimism are scheduled to open Sept. 29 at 08:00 UTC. USDT withdrawals on Ethereum, BNB Smart Chain, Solana and Tron will follow Sept. 30 at 08:00 UTC. Bitget projects full restoration of remaining assets, fiat withdrawals and peer-to-peer transactions by Oct. 2.
The breach stemmed from a vulnerability in a third-party security tool, not in Bitget's internal wallet code. Attackers exploited the weakness to obtain high-level internal credentials, which they used to send fraudulent withdrawal commands that bypassed existing risk controls. Unauthorized transfers began around 6:31 p.m. UTC on Sept. 24.
Assets moved from Bitget's hot and warm wallet infrastructure across multiple networks included Ether, USDT, USDC, AVAX and BNB. Bitget said private keys were not compromised and that user account balances and cold wallets remained unaffected. The exchange has patched the vulnerability and reported no further unauthorized transfers.
