On September 28, Bitget began a phased restoration of fund withdrawals following a significant hack totaling $388 million. The first cryptocurrency to have withdrawals enabled was Bitcoin, available on both the main Bitcoin network and Binance Smart Chain (BSC).
Quick recap from today's livestream:
— Gracy Chen @Bitget (@GracyBitget) September 28, 2026
1. Withdrawals
BTC live on Bitcoin Mainnet & BSC — 9,585 orders, 4,098.036 BTC processed as of 17:00 UTC+8. ETH, USDT, others follow in phases starting tomorrow.
2. What happened
Full trace-back complete. The attacker exploited… pic.twitter.com/BmyTNFJgFC
In the first hour after the withdrawal feature was reactivated, the platform processed 9,585 requests, totaling approximately 4,098 BTC.
Ethereum withdrawals are set to resume on September 29, followed by USDT on September 30. Other supported tokens, as well as fiat and P2P services, are expected to return on October 2.
Gracy Chen, CEO of Bitget, stated that the exchange has addressed the vulnerability exploited by the attackers.
After the incident was contained, the security team reported no further unauthorized transfers. User balances remained unaffected.
Attack Vector
Investigations revealed that the attackers took advantage of a vulnerability in a third-party security product, gaining access to privileged internal credentials.
Using these credentials, they sent fraudulent withdrawal commands to the wallet system, bypassing existing risk control mechanisms and resulting in abnormal transfers.
Bitget assured that private keys and cold wallets were secure.
Previously, the company reported a breach of a critical component of its wallet infrastructure and tampering with transaction data.
As a result, the exchange is reevaluating its approach to assessing and implementing third-party security solutions, as well as its internal access control mechanisms and verification processes for withdrawal operations and detection of suspicious activities.
Investigation Ongoing
Initially, Bitget estimated the financial impact of the hack at $351.6 million. This figure was later revised to $388 million after accounting for transactions on the Zcash and TRON networks.
The exchange clarified that this adjustment was due to a reconciliation of operations related to the initial incident, not new transfers.
Forensic investigations are being conducted by Mandiant and SlowMist, who are analyzing the attack vector, reviewing containment measures, and assisting in asset tracking.
Bitget is also collaborating with law enforcement and industry participants, with a portion of the stolen funds already having been frozen.
An official security report from Bitget is expected to be published within this week.
On September 26, Chen urged the THORChain protocol to refuse service to the attacker's addresses. However, the developers declined the request, citing the network's architecture that does not allow for censorship.
Follow ForkLog on social media
Telegram (main channel) Facebook X