Bitget Reopens Bitcoin Withdrawals After $388M Exploit

Bitget has started processing Bitcoin withdrawals again, the first step in a staged return of services after an exploit drained roughly $388 million from the exchange.

The change is useful, but it doesn’t settle the question many customers will have: whether every affected balance is actually available to withdraw. Bitget says user balances were unaffected, though the supplied reports do not independently verify that users can access those funds in practice.

The withdrawal schedule starts with Bitcoin

Bitget began processing withdrawals on the Bitcoin network at 8 a.m. UTC on Sept. 28. It had previously scheduled Bitcoin as the first phase of the resumption.

That small ordering matters. An exchange doesn’t need to reopen every network at once. Each chain has to pass a separate set of security checks, so returning one network first gives Bitget a limited way to test the withdrawal system without immediately reopening every route at the same time.

The scheduled return of other services is spread over several days:

• Sept. 29, 8 a.m. UTC: ETH withdrawals on Ethereum, BNB Smart Chain, Arbitrum, Base and Optimism.
• Sept. 30, 8 a.m. UTC: USDT withdrawals on Ethereum, BNB Smart Chain, Solana and Tron.
• Oct. 2: All remaining assets, fiat withdrawals and peer-to-peer transactions.

Only the Bitcoin opening was confirmed as having begun in the available reporting. The later dates were still scheduled when the articles were published, so they shouldn’t be treated as completed updates.

What the attacker reached

The unauthorized transfers began at around 6:31 p.m. UTC on Sept. 24 across several networks. According to Bitget, an attacker exploited a vulnerability in a third-party security product and obtained high-level internal credentials.

Bitget says those credentials were then used to send fraudulent withdrawal commands that bypassed risk controls. A separate report said investigators found the attackers reached a critical backend component and used spoofed transaction data to trigger legitimate authorization processes.

The exact list of transferred assets remains unsettled. The Block previously identified ether, USDT, USDC, AVAX and BNB among them. Another report included XRP and later Zcash- and Tron-related transfers. Bitget’s latest statement didn’t name the assets, and the third-party product carrying the vulnerability hasn’t been disclosed.

The balance question remains open

Bitget says its private keys weren’t compromised and that its cold wallets and user balances were unaffected. It also says losses will be fully covered by the Bitget User Protection Fund, which it says holds 5,500 BTC. A second report described the fund as holding more than $464 million in publicly verifiable assets.

That is reassurance from the exchange, not independent confirmation that every customer’s balance can be withdrawn. Trading and deposits remained available during the suspension, but reopening a trading platform is not the same as restoring every withdrawal route.

For now, Bitcoin withdrawals have restarted. The harder evidence will come from customers successfully withdrawing ETH, USDT and other assets as each scheduled opening passes.