Bitget restarts bitcoin withdrawals after $388m breach
The exchange says attackers used stolen credentials from a third-party security flaw, not private keys, and that customer balances are intact as withdrawals resume.
Key points
- Bitget says about $388 million was stolen on Sept. 24 after attackers exploited a third-party security product.
- By 9 a.m. UTC on Sept. 28 it had processed 9,585 bitcoin withdrawals totalling 4,098 BTC.
- ETH withdrawals are due to resume Sept. 29, USDT on Sept. 30 and other services on Oct. 2.
- The exchange says private keys and cold wallets were not compromised and customer balances are unaffected.
- Mandiant and Slowmist are assisting, and Bitget expects to publish a security report this week.
Bitget has begun restoring bitcoin withdrawals after a $388 million breach, the exchange told Bitcoin.com News, saying attackers exploited a vulnerability in a third-party security product rather than breaking its own cryptography. The company said its private keys and cold wallets were never compromised and that customer balances remain intact.
Bitget said it started reopening BTC withdrawals across the Bitcoin and BSC networks at 8 a.m. UTC on Sept. 28. By 9 a.m. it had processed 9,585 bitcoin withdrawals totalling about 4,098 BTC. Further cryptocurrency withdrawals are scheduled to resume through the week, with ETH due on Sept. 29, USDT on Sept. 30 and other supported tokens, fiat and peer-to-peer services on Oct. 2.
The incident began on Sept. 24, when attackers exploited a flaw in an external security product. Bitget's initial investigation found they obtained high-level internal credentials that let them issue fraudulent withdrawal commands to the exchange's wallet system, bypassing existing risk controls. The compromised infrastructure allowed unauthorised transfers across several blockchain networks, including Ethereum, XRP Ledger and Tron, with platforms such as Thorchain and rails including Uniswap, 1inch Fusion and Stargate also used.
Withdrawals resume after breach
Bitget first put the damage at $351.6 million before reconciliation raised the figure to roughly $388 million. The company said the revised estimate does not represent additional unauthorised transfers after containment. It added that it has identified the attack path, remediated the vulnerability and strengthened controls across its withdrawal infrastructure, and is reviewing third-party security dependencies, internal access controls, withdrawal verification and abnormal activity detection.
In a Sept. 28 statement attributed to CEO Gracy Chen, the exchange said the incident was the first attack of its kind to breach its infrastructure in eight years, adding that the record does not diminish its seriousness. Chen has previously said the attack methodology appeared highly consistent with North Korean-linked groups, though the investigation continues.
Forensic specialists Mandiant and Slowmist are helping with the investigation, examining attack methods, validating remediation and tracking the missing cryptocurrency. Bitget said some affected assets have already been frozen through coordination with industry partners, and it has shared attacker addresses and tracing information to help follow the money.
Stolen credentials bypassed controls
The exchange reported a comprehensive reserve ratio of 127% and a User Protection Fund exceeding $464 million, which it says remains available to customers. Bitget expects to complete an official security report this week and said it will apply the findings across the platform as its infrastructure and product range grow.