Bitget began restoring withdrawals on Monday, starting with bitcoin, four days after an exploit drained about $388 million from the exchange’s hot and warm wallets.
A staggered return
BTC withdrawals opened at 8:00 a.m. UTC on Sept. 28, with each chain required to clear a round of security checks before it comes back online.
ETH withdrawals on Ethereum, BSC, Arbitrum, Base and Optimism are scheduled to follow on Sept. 29, with USDT on Ethereum, BSC, Solana and Tron returning on Sept. 30.
All remaining tokens, fiat withdrawals and P2P transactions are set to come back on Oct. 2.
Bitget said the rollout applies to every user equally, and that trading and deposits have kept running throughout.
How the attack happened
The unauthorized transfers began around 6:31 p.m. UTC on Sept. 24, after the attacker exploited a flaw in a third-party security product to obtain high-level internal credentials.
The exchange described what followed in a statement:
“The attacker then used these credentials to send fraudulent withdrawal commands to the wallet system, causing it to execute abnormal transfers that bypassed risk controls.”
Bitget said its private keys, cold wallets and user balances were not compromised, and that the vulnerability has since been patched.
Mandiant and SlowMist are assisting with the investigation, and an official security report is expected this week.
Losses covered by protection fund
The $388 million theft is the largest reported crypto hack of 2026 so far, surpassing earlier incidents at KelpDAO and Drift Protocol.
Bitget said the losses will be fully absorbed by its User Protection Fund, which holds 5,500 BTC.
The exchange has also launched a bounty offering 5% of any attacker funds frozen or recovered, and said some assets have already been frozen with help from industry partners.
It described the attackers as “sophisticated” and “state-backed,” and has previously told media it suspects North Korea was behind the attack.
CEO Gracy Chen was scheduled to host a live AMA at 7:30 a.m. UTC on Monday to walk through the incident and the withdrawal restoration.
