Bitget begins phased withdrawal resumption after security breach

Bitget has started the phased resumption of withdrawals following the security event on September 24, with BTC being the first asset to be restored on September 28.

The attack path has been identified, the vulnerability addressed, and user balances have not been impacted, Bitget said. A complete security report is due this week.

First withdrawals restored as part of phased plan

As scheduled, BTC withdrawals on the Bitcoin and BSC networks were reinstated at 08:00 UTC on September 28. This step came after further security checks were carried out on Bitget’s withdrawal systems.

Earlier on September 28, CEO Gracy Chen held a live AMA where she discussed the incident, the withdrawal procedure, and future actions.

Eight years of security and the path forward

In eight years of operation, Bitget has not faced a security incident of this kind. The vulnerability has been fixed, and no additional unauthorized movements have been detected since the incident was contained.

Over the past eight years, the digital asset security landscape has evolved markedly. Attack methods have grown more advanced, systems are more linked, and security breaches carry graver implications.

Bitget’s security measures have developed in response to these risks. During this period, the exchange has improved its wallet systems and risk management, implemented monthly Proof of Reserves, and created a User Protection Fund.

Currently, Bitget’s comprehensive Proof of Reserves ratio is 127%, and its User Protection Fund exceeds $464 million.

This track record does not lessen the gravity of the incident. Instead, it establishes the benchmark for evaluating Bitget’s response.

How the security breach occurred

According to the investigation, the attacker leveraged a flaw in a third-party security tool to gain elevated internal access. Those credentials were then employed to issue fake withdrawal instructions to the wallet system.

These unusual transactions circumvented risk safeguards. Private keys stayed secure, and cold wallets were untouched.

Bitget acknowledges that the security of third-party systems incorporated into its infrastructure falls under its own security obligations. After the event, the exchange has adopted more stringent evaluation standards for third-party products, tighter deployment controls, and independent withdrawal validation.

Additionally, the platform is enhancing internal authorization controls, withdrawal confirmation processes, and monitoring for irregular activity.

Investigation and recovery progress

Bitget has stated that roughly $388 million worth of assets were moved out during the security event. That amount is based on the most recent reconciliation and categorization of transactions linked to the incident.

Mandiant and SlowMist are still assisting with the independent forensic investigation. Their efforts encompass the attack vectors and techniques employed, verification of containment and remediation actions, and asset tracing.

Bitget is cooperating with law enforcement, other exchanges, blockchain projects, on-chain security experts, and industry partners on tracking and retrieval. Some impacted assets have been frozen, and the exchange has released identified attacker addresses and related tracking data.

An official security report is expected to be finalized this week by Bitget. The report will contain detailed findings, and additional material updates will be communicated as they are confirmed.

Withdrawal resumption timeline

ETH withdrawals on Ethereum, BSC, Arbitrum, Base, and Optimism are set to restart on September 29 at 08:00 UTC. USDT withdrawals on Ethereum, BSC, Solana, and Tron are scheduled for September 30 at 08:00 UTC.

The resumption of withdrawals for other supported tokens, fiat currencies, and P2P services is set for October 2 at 08:00 UTC. Withdrawal availability will be updated directly on the Bitget platform.

By 09:00 UTC on September 28, 9,585 users had started withdrawals, totaling roughly 4,098 BTC since the resumption began. Withdrawal operations are currently running normally.

User and institutional initiatives

In conjunction with the withdrawal restart, Bitget is launching two time-limited programs for qualifying users and professional clients.

Under the Bitget Alliance Program, eligible users can earn a share of transaction fees from trading on the platform. The program is active from September 28 at 08:00 UTC to October 26 at 08:00 UTC. More information can be found here.

Project Stand Together provides eligible PRO clients and market makers with special fee discounts and extended PRO level protection. The preferential rates are in effect from September 28 at 10:00 UTC to October 30 at 09:00 UTC, and PRO level protection continues until November 30 at 09:00 UTC. Complete details are available here.

Bitget will keep issuing updates as the investigation, withdrawal restart, and asset recovery move forward.