- Bitget began restoring Bitcoin withdrawals at 8:00 UTC on Sept. 28 after a Sept. 24 exploit that drained about $388 million.
- The exchange said attackers compromised a backend wallet system and spoofed transaction data; private keys were not stolen.
- A User Protection Fund of more than $464 million is covering the loss, and customer balances were not written down.
- Ether, USDT and remaining assets are scheduled to return in stages through Oct. 2.
Bitget began a phased resumption of withdrawals on Monday, starting with bitcoin at 8:00 UTC, four days after an exploit drained about $388 million from hot and warm wallets. The exchange said in an official support notice that the vulnerability has been patched and that each chain must pass extra security checks before withdrawals reopen.
Unauthorized transfers were detected at 18:31 UTC on Sept. 24. Bitget first put the affected amount at about $351.6 million, then raised the figure to roughly $387.5 million after on-chain tracing added assets on Zcash and TRON, according to a fund-tracing update. That total makes the incident the largest reported crypto theft of 2026 so far. Cold wallets were not compromised, and deposits and trading stayed open throughout the pause.
In a follow-up on X, CEO Gracy Chen said the attacker “compromised a critical backend system within our wallet infrastructure, used it to spoof transaction data, and triggered our authorization process to move funds out.” She added that private-key compromise has been ruled out and that no further unauthorized transfers are possible. Chen later said IP and VPN patterns made a North Korea-linked group “very likely”, an attribution that remains under investigation with Mandiant and SlowMist.
Stolen assets included XRP, ether, USDT, USDC, BNB, AVAX, ZEC and TRX across several networks. Circle and Tether later froze about $318,000 in related stablecoins, a small slice of the haul. Bitget is offering a 5% bounty for help freezing or recovering funds.
Chen told users in her initial security notice that “the full amount of this loss falls within the coverage of Bitget’s User Protection Fund, which currently holds over $464 million.” The firm later said the reserve holds 5,500 BTC and that it will replenish the fund after covering the incident. Covering the full revised loss would consume most of that backstop, leaving the reserve well below the exchange’s stated $300 million floor unless recoveries or a top-up arrive quickly.
Under the published timetable, ETH withdrawals on Ethereum, BSC, Arbitrum, Base and Optimism open at 8:00 UTC on Sept. 29, USDT on Ethereum, BSC, Solana and Tron on Sept. 30, and remaining tokens, fiat and P2P on Oct. 2. Chen hosted a live AMA at 7:30 UTC Monday, 30 minutes before bitcoin withdrawals restarted, and said Bitget was taking a slower, chain-by-chain approach than Bybit did after its 2025 breach in order to reduce risk.
