Bitget Resumes Bitcoin Withdrawals and Details Exploit Behind $387.5M Breach

Bitget has started reopening withdrawals after a $387.5 million security exploit struck the platform, with CEO Gracy Chen outlining the specific vector attackers used to breach internal systems.

Bitcoin withdrawals are now functional across the Bitcoin mainnet and BNB Smart Chain. According to Chen, the exchange had handled 9,585 withdrawal transactions totaling 4,098.036 BTC as of 17:00 UTC+8 on Monday.

The exchange initially halted user redemptions following the September 24 incident, which was first spotted when unauthorized outflows began at 18:31 UTC. Bitcoin withdrawals were brought back online at 08:00 UTC Monday after security teams finalized system reviews, while withdrawals for Ether, USDT, and remaining tokens are slated to reopen in phases running through October 2.

Detailing the attack path, Chen explained that the intruder took advantage of security flaws in third-party products to harvest internal credentials. The attacker subsequently leveraged that access to submit unauthorized withdrawal requests that bypassed the platform's risk management safeguards.

Chen confirmed that private keys were not compromised and that Bitget's cold storage infrastructure remained untouched throughout the incident. The team responded by isolating affected servers, revoking and generating fresh internal credentials, and reconfiguring permissions around critical systems. Bitget also reached out to the third-party vendor and shut down the compromised tool until the flaw is fixed.

Security firms Mandiant and SlowMist are assisting Bitget with forensic analysis and tracking stolen funds. Bitget initially calculated the damage at $351.6 million, later revising the figure to roughly $387.5 million after discovering additional transfers on Zcash and TRON. The exchange clarified that the higher total reflected a more thorough audit rather than ongoing theft.

Bitget stated that customer account balances are unaffected and that the incident will be covered entirely by its Protection Fund. The reserve held over $464 million before the breach was announced, and Chen said the exchange plans to inject its own capital to return the fund above $300 million within a week. Bitget has maintained an ongoing target to keep the reserve above $300 million, with August figures showing an average monthly balance of $382 million.

Chen also revealed Project Stand Together, a program designed to provide a trading-fee reward pool alongside added protections for retail users, VIP accounts, professionals, and market makers. She noted that the breach represents Bitget's first security incident of this type in eight years.