Bitget has started restoring withdrawals after attackers transferred approximately $387.5 million from portions of the exchange’s hot and warm wallet infrastructure, while forensic investigat
Bitget has started restoring withdrawals after attackers transferred approximately $387.5 million from portions of the exchange’s hot and warm wallet infrastructure, while forensic investigators continue tracing the stolen assets and examining the breach.
The attackers exploited a vulnerability in a third-party security product to obtain internal access credentials before submitting forged withdrawal commands directly to Bitget’s wallet systems. Those instructions were treated as authorized activity and bypassed existing risk checks. Private keys were not compromised, and Bitget’s cold wallets remained unaffected.
The final affected amount rose from the $351.6 million breach initially identified on September 24 to $387.5 million after additional Zcash and TRON transactions were classified.
BTC withdrawals reopened at 08:00 UTC on September 28 on Bitcoin and BNB Smart Chain after additional security checks across Bitget’s withdrawal infrastructure.
ETH withdrawals are scheduled for September 29 at 08:00 UTC across Ethereum, BNB Smart Chain, Arbitrum, Base and Optimism. USDT follows on September 30, while remaining tokens, fiat withdrawals and P2P services are scheduled for October 2. Trading and deposits remained available during the withdrawal suspension.
Bitget’s Protection Fund held more than $464 million when the incident was assessed, exceeding the currently identified loss. The exchange has designated the fund to absorb the financial impact while leaving user account balances unchanged.
Bitget has not formally attributed the breach to North Korea or another state-backed group. Mandiant and SlowMist are conducting the independent forensic investigation, and attacker attribution remains outside the exchange’s confirmed findings while that work continues.
The investigation has already moved beyond containment into fund tracing and recovery. Some affected assets have been frozen through coordination with exchanges, blockchain projects and security firms, while Bitget is offering a 5% bounty for eligible voluntary actions that directly result in assets being frozen or recovered.
Efforts to restrict the stolen funds have also created a dispute over permissionless cross-chain infrastructure. THORChain rejected Bitget’s request to block identified exploiter addresses, triggering a wider decentralization debate over whether validator-operated protocols should intervene when known stolen assets move through their systems.
Bitget has ruled out private-key compromise and isolated the affected systems, while controls around third-party security products, internal access, withdrawal verification and abnormal-activity monitoring are being strengthened.
ETH withdrawals remain scheduled to open at 08:00 UTC on September 29, followed by USDT on September 30 and the remaining withdrawal services on October 2.
The post Bitget Restores BTC Withdrawals After $387.5M Breach as Forensics Continue appeared first on Crypto Adventure.
