Bitget Resumes Withdrawals In Phases After Security Incident

What Happened

Bitget’s security framework has evolved alongside those risks. Over the past eight years, the company has strengthened its wallet infrastructure and risk controls, introduced monthly Proof of Reserves and established a dedicated User Protection Fund.

The investigation found that the attacker exploited a vulnerability in a third-party security product to obtain high-level internal credentials. These credentials were used to send fraudulent withdrawal commands to the wallet system.

Bitget recognizes that the security of third-party systems integrated into its infrastructure forms part of its own security responsibility. Following the incident, the company has introduced stricter assessment criteria for third-party products, stronger controls around their deployment and independent verification for withdrawals.

Investigation and recovery

Mandiant and SlowMist continue to support the independent forensic investigation. Their work covers the attack vectors and methods used, validation of containment and remediation measures, and asset tracing.

Market Context

Bitget has begun restoring withdrawals after the September 24 security incident, starting with BTC on September 28.

Phased withdrawal resumption begins

Why It Matters

The exchange has identified the attack path, remediated the vulnerability and confirmed that user balances remain unaffected, with a full security report expected this week.

The resulting abnormal transfers bypassed risk controls. Private keys were not compromised, and cold wallets were not affected.

Bitget expects to complete an official security report this week. Detailed findings will be disclosed through that report, with further material developments shared as they are verified.

Details

BTC withdrawals on the Bitcoin and BSC networks resumed at 08:00 UTC on September 28, as scheduled. The resumption follows additional security work across Bitget’s withdrawal infrastructure.

Earlier the same day, Bitget CEO Gracy Chen addressed the incident, the withdrawal process and next steps during a live AMA.

Eight years of security and what comes next

The September 24 incident is the first security incident of this nature affecting Bitget Exchange in eight years of operation. The vulnerability has been remediated, and no further unauthorized transfers have been identified since containment.

The security environment around digital assets has changed significantly over that period. Attacks have become more sophisticated, infrastructure more interconnected, and the consequences of a security failure more serious.

Bitget currently reports a comprehensive Proof of Reserves ratio of 127%, while the User Protection Fund stands at more than $464 million.

That record does not diminish the seriousness of the incident. It sets the standard against which Bitget’s response should now be measured.

How the attack happened

It is also strengthening internal access controls, withdrawal verification and abnormal activity monitoring across the platform.

Bitget has confirmed that approximately $388 million in assets were transferred out during the incident. The figure reflects the latest reconciliation and classification of transactions associated with this incident.

Bitget is also working with law enforcement, exchanges, blockchain projects, on-chain security specialists and other industry partners on tracing and recovery. Some affected assets have already been frozen, and Bitget has published identified attacker addresses and relevant tracing data.

Withdrawal schedule

ETH withdrawals across Ethereum, BSC, Arbitrum, Base and Optimism are scheduled to resume on September 29 at 08:00 UTC. USDT withdrawals across Ethereum, BSC, Solana and Tron follow on September 30 at 08:00 UTC.

Other supported tokens, fiat and P2P services are set to resume on October 2 at 08:00 UTC. Withdrawal availability will continue to be reflected directly on the Bitget platform.