Bitget Begins Phased Withdrawals After $387.5M Security Breach

Bitget has begun restoring withdrawals after a Sept. 24 security breach that led to approximately $387.5 million in unauthorized asset transfers, with Bitcoin withdrawals restarting on Sept. 28 as the exchange continues its recovery efforts.

The exchange said withdrawals would resume in stages from 08:00 UTC on Sept. 28, beginning with Bitcoin. Ether withdrawals are scheduled to resume on Sept. 29, USDT on Sept. 30, and other supported tokens, fiat and peer-to-peer services on Oct. 2.

Bitget Restores Withdrawals in Stages

The phased restart follows Bitget’s decision to temporarily suspend withdrawals after detecting unauthorized transfers from part of its hot and warm wallet infrastructure on Sept. 24.

According to Bitget, an attacker compromised a critical backend system within its wallet infrastructure, used it to spoof transaction data and triggered the authorization process for unauthorized transfers. The exchange said the underlying vulnerability has since been identified and remediated, with Mandiant and SlowMist supporting the investigation and additional security checks.

Bitget said its cold wallets were not affected and that its investigation to date has ruled out a compromise of private keys. Its separate self-custodial Bitget Wallet was also unaffected.

Breach Estimate Rises to $387.5 Million

Bitget initially estimated that approximately $351.6 million in assets had been affected. The figure was later revised to $387.5 million after further transaction classification identified additional transfers involving Zcash and TRON.

Bitget said the higher figure reflects a more complete accounting of the original incident rather than additional unauthorized transfers after the breach was contained. The affected assets include XRP, ETH, USDT, ZEC, USDC, USDT0, XAUt, BNB, AVAX and TRX.

The exchange said customer account balances remain unaffected and that its User Protection Fund covers the financial impact of the incident.

Stolen XRP Continues to Move

The recovery effort remains ongoing as some of the stolen assets continue to move on-chain.

CoinDesk reported that approximately $83 million worth of stolen XRP had been moved from three wallets linked to the breach, leaving about $75 million across the original holding wallets at the time of its report.

The movement creates an additional challenge for recovery efforts because XRP, as the native asset of the XRP Ledger, cannot be frozen at the protocol level. Centralized exchanges can still restrict accounts if stolen funds reach their platforms.

Recovery Efforts Continue

Bitget has launched a Recovery Bounty Program as it works with blockchain projects, exchanges and cybersecurity firms to trace and freeze affected assets.

The exchange said some funds have already been frozen through coordination with industry participants, while Mandiant and SlowMist continue to support the investigation. Bitget has also made live tracing information available to organizations involved in the recovery effort.

The incident has therefore shifted into a second phase: restoring customer withdrawal access while continuing to trace the assets transferred during the breach.

Under Bitget’s current schedule, BTC withdrawals restart on Sept. 28, followed by ETH on Sept. 29, USDT on Sept. 30, and other supported tokens, fiat and P2P services on Oct. 2. The exchange said additional security validation will continue as the phased restoration proceeds.