Bitget resumes Bitcoin withdrawals after a $388 million hack, addressing the exploited vulnerability and ensuring user balances are secure.
Bitget has resumed Bitcoin withdrawals following a major security breach that resulted in losses estimated at $388 million. The exchange began the phased restoration of fund withdrawals on September 28, starting with Bitcoin, which is now accessible on both the main Bitcoin network and Binance Smart Chain (BSC).
In the first hour of reactivation, the platform processed 9,585 withdrawal requests totaling about 4,098 BTC, according to CEO Gracy Chen.
Withdrawals for Ethereum are set to restart on September 29, followed by USDT on September 30. Other tokens, along with fiat and P2P services, are expected to be reinstated by October 2.
Chen confirmed that the exchange has successfully addressed the security vulnerability that was exploited during the attack. After the incident, the security team reported no further unauthorized transactions, and user balances remained intact.
Details of the Attack
Investigations revealed that the attackers exploited a flaw in a third-party security product to gain access to internal credentials. This allowed them to issue fraudulent withdrawal commands, circumventing existing risk controls and resulting in abnormal transfers.
Bitget has assured users that private keys and cold wallets remain secure, despite previously reporting a breach in a critical component of its wallet infrastructure.
As a result of the breach, the exchange is re-evaluating its approach to third-party security measures and internal access controls to enhance its withdrawal verification processes.
Ongoing Investigation
Initially, Bitget estimated the hack's financial impact at $351.6 million, but this was later revised to $388 million after accounting for transactions involving Zcash and TRON. The adjustment was due to a reconciliation of operations related to the breach, not new transfers.
Forensic investigations are being conducted by Mandiant and SlowMist to analyze the attack vector and assist with asset tracking. Bitget is also cooperating with law enforcement, and some of the stolen funds have already been frozen.
An official security report is expected from Bitget within the week. On September 26, Chen requested that the THORChain protocol refuse service to the attacker's addresses, but the developers declined, citing the network's non-censorship architecture.
