Key updates

• Bitget opened BTC withdrawals on Sept. 28 under a staged restoration plan, according to PANews.
• On-chain analyst Ai Yi said 2,042.28 BTC, about $169 million, moved from Bitget's protection fund to its hot wallet.
• Bitget CEO Gracy Chen put funds moved to attacker wallets at about $388 million, up from an initial $351.6 million.
• Xie Jiayin said attackers used a third-party security flaw to get intranet credentials and forge withdrawal orders.

Bitget opened bitcoin withdrawals on Sept. 28, the first step in a staged return to normal service after a hack that the exchange now says cost about $388 million. On-chain analyst Ai Yi said 2,042.28 BTC, roughly $169 million, has moved from Bitget's 5,500 BTC protection fund into its hot wallet, leaving 3,457.72 BTC on-chain, according to Odaily.

The exchange is bringing services back chain by chain rather than all at once. ETH networks are set to open Sept. 29 at 16:00 UTC+8, USDT networks on Sept. 30, and other tokens, fiat and C2C services from Oct. 2, according to PANews. CEO Gracy Chen and Greater China head Xie Jiayin are hosting a session to explain the plan.

The numbers have moved since the first disclosure. Chen initially put losses at $351.6 million across 19 transfers from hot and warm wallets, with cold wallets untouched, according to Odaily. By Sept. 25 she had raised the figure to $387.5 million, according to SoildIntel, and by Sept. 28 she described about $388 million moved by the attacker, according to PANews.

Withdrawals return in stages

Bitget says the money to cover the hole is already set aside. The exchange's Protection Fund holds 5,500 BTC, worth about $464 million at current prices, with all wallet addresses public and verifiable on-chain, according to PANews. Xie Jiayin said the fund fully covers losses and that reserves stand at 127%.

The cause is the part that matters most for anyone deciding whether to keep funds on the exchange. Xie Jiayin said attackers exploited a flaw in a third-party security product to obtain Bitget intranet credentials and send forged withdrawal instructions to the wallet system, according to Odaily. He said private key leaks and insider involvement have been ruled out.

That account lines up with what Chen said earlier. She said the root cause was undetermined at the time, no private keys were obtained, and withdrawals would stay paused, according to Odaily. The attack spanned multiple chains, which is why Bitget paused everything and is restarting in stages rather than flipping a single switch.

What Bitget says happened

The stolen money is already moving. AMLBot monitoring shows funds taken from Bitget appear to have begun being laundered through Wasabi CoinJoin, a tool that mixes bitcoin transactions to obscure their trail, according to PANews. About 4 BTC in one CoinJoin round traces back to a Bitget TRON wallet: TRX was swapped to USDT, bridged to Ethereum via USDT0 for about 145 ETH, then swapped again.

For investors, the practical question is whether a reopened withdrawal window stays open. Exchanges that resume payouts after a breach often face a rush of exits, and Bitget's staged schedule gives users on different chains different dates. The protection fund is the buffer, but it is also the number to watch: it started at 5,500 BTC and has already sent 2,042.28 BTC to the hot wallet.

There is a wider point about how these attacks happen. The Bitget case, as described by its own executives, did not involve a stolen private key or a compromised cold wallet. It involved credentials and a third-party product, the kind of supplier risk that exchanges share with the rest of the financial system and that users rarely get to assess.

What to watch next

The market backdrop is soft. Bitcoin traded at $82,875, down 2.29% in 24 hours, and Ethereum at $2,648, down 2.64%, according to InvestIn.News market data at 08:35 UTC on Sept. 28. Total crypto market value stood at $2.83 trillion, down 4.91%, while the Crypto Fear & Greed Index read 74 of 100, in Greed.

What to watch next is whether the later stages hold to schedule. ETH on Sept. 29, USDT on Sept. 30 and everything else from Oct. 2 are the dates Bitget has given, and any slippage would be read as a sign that checks are still finding problems. The other marker is the protection fund's remaining balance and whether the exchange refills it as promised.

One unrelated on-chain move is worth noting for context on how large holders behave. A whale transferred 1.37 million UNI, worth about $12.83 million, through an intermediary address to a Wintermute hot wallet, in what appears to be an over-the-counter position reduction, according to Odaily. The tokens were withdrawn from Coinbase Prime.

Follow the latest Bitcoin updates as they happen on Bitcoin NewsFeeds.

Sources

• Odaily: Bitget opens BTC withdrawals; over 2,000 BTC from protection fund moved to hot wallet (2026-09-28)
• SoildIntel: Bitget CEO says $387.5 million moved to attacker wallets in Sept. 24 hack (2026-09-25)
• PANews: Bitget says hot wallet losses will be covered by Protection Fund holding 5,500 BTC (2026-09-25)
• Odaily: Bitget CEO says stolen funds hold at $351.6m, private keys not taken (2026-09-25)
• Odaily: Xie Jiayin: private key leak and insider involvement ruled out in Bitget incident (2026-09-28)
• Odaily: Bitget says $464 million protection fund covers attack losses; withdrawals to resume in stages (2026-09-28)
• PANews: Bitget opens BTC withdrawals as phased service restoration begins (2026-09-28)
• PANews: Bitget CEO says hackers moved about $388 million; protection fund to be refilled above $300 million (2026-09-28)
• Odaily: Whale moves 1.37 million UNI worth $12.83 million to Wintermute (2026-09-28)
• PANews: AMLBot: part of Bitget stolen funds being mixed via Wasabi CoinJoin (2026-09-27)

This article was drafted with AI assistance from the reporting listed above, then checked and edited by our writer.