Bitget resumes bitcoin withdrawals four days after $387.5 million breach
Bitget reopened bitcoin withdrawals at 08:00 UTC on Sep. 28 after a Sep. 24 breach that moved about $387.5 million to attacker-controlled addresses.
Why it matters
Bitget says customer balances were unaffected and that its User Protection Fund absorbs the loss, so the reopened withdrawal pipes rather than depositor balances are what the restart puts on the line, and P2P and fiat withdrawals stay closed until Oct. 2. The stated attack path, credentials taken from a third-party security product, points at vendor access controls that other exchanges using similar tooling also depend on, while the attacker was still converting stolen assets through Binance and THORChain after the breach.
Where the sources disagree
Total value moved to attacker-controlled addresses
about $351.6 million, the initial Bitget estimate
Bitcoin.com News, Cointelegraph, CryptoSlate
about $387.5 million, the revised Bitget estimate
Bitcoin.com News, Unchained, Crypto.News, Cointelegraph, CryptoSlate, Crypto.News
approximately $388 million
Unchained, Bitcoin.com News
approximately $352 million in XRP and ether tokens
Bitcoin Insider
Bitget's initial estimate was revised upward, and outlets round or report the revised figure differently.
Whether Bitget publicly confirmed a loss figure
Bitget has not publicly confirmed the exact loss figure
Bitcoin Insider
Bitget has confirmed approximately USD 387.5 million moved to attacker-controlled addresses
Crypto.News
Bitcoin Insider said Bitget had not publicly confirmed the exact loss figure and that early reports varied, while several other outlets reported Bitget confirming roughly $387.5 million.
Size of Bitget's User Protection Fund
5,500 BTC worth about $462 million, covering the $387.5 million loss while BTC stays above $70K
Bitcoin.com News
more than $464 million
Bitcoin.com News
above $300 million as of Sep. 30
Crypto.News
Reported fund values differ, and CEO Gracy Chen said on Sep. 30 that the fund had come back above $300 million after the incident.
Which assets the attacker took
XRP and ether tokens
Bitcoin Insider
additional unauthorized transfers identified on Zcash and Tron
Bitcoin.com News, Cointelegraph
Bitcoin Insider is the only outlet in the set that names the drained assets, and its named pair does not match the chains Bitget cited in its own estimate revisions.
Figures that do not reconcile
Found by comparing the numbers in the reports automatically. They are differences, not yet confirmed to be about the same thing.
amount taken (bitget)
$388 Million
Unchained
$351.6 million
Cointelegraph
Unchained reports $388 Million, Cointelegraph reports $351.6 million (9% apart).
reported flows (bitget processed withdrawals)
4,098.036 BTC
TheNewsCrypto
9,585 BTC
Bitcoin.com News
TheNewsCrypto reports 4,098.036 BTC, Bitcoin.com News reports 9,585 BTC (57% apart).
amount taken (exchange)
$351.6 million
Cointelegraph
$388 million
Bitcoin.com News
Cointelegraph reports $351.6 million, Bitcoin.com News reports $388 million (9% apart).
Key facts
Bitget reopened bitcoin-network withdrawals at 08:00 UTC on Sep. 28, the first stage of a phased restart running to Oct. 2.
Reported by Crypto News Flash
Bitget says the attacker exploited a vulnerability in a third-party security product to obtain high-level internal credentials and send fraudulent withdrawal commands.
Reported by Crypto.News
Bitget detected unauthorized transfers from some hot wallets at about 18:31 UTC on Sep. 24, then suspended withdrawals while trading and deposits stayed open.
Reported by Crypto.News
Bitget says private keys and cold wallets were never compromised.
Reported by Cointelegraph
Crypto.News reported THORChain rejected Bitget's request to block the attacker addresses, and Cointelegraph reported the attacker swapping ether through THORChain.
Reported by Crypto.News
What happened
Bitget resumed bitcoin withdrawals on the Bitcoin network at 08:00 UTC on Sep. 28, four days after freezing customer withdrawals over a breach that began at about 18:31 UTC on Sep. 24. The exchange says the attacker exploited a vulnerability in a third-party security product to obtain internal credentials and forge withdrawal commands, leaving private keys and cold wallets untouched, and raised its estimate of assets moved to attacker-controlled addresses from $351.6 million to about $387.5 million after counting transfers on Zcash and Tron. Unchained and Bitcoin.com News report the figure as $388 million, while Bitcoin Insider, citing reports that differ, gives roughly $352 million in XRP and ether and says Bitget had not confirmed a loss figure. Ether withdrawals reopened on Sep. 29 and USDT on Sep. 30, with P2P, fiat and remaining tokens due at 08:00 UTC on Oct. 2, and Bitget said 9,585 orders totalling 4,098.036 BTC had cleared by 9 a.m. UTC on Sep. 28. Mandiant and SlowMist are helping investigate, and the stolen funds kept moving: Lookonchain tracked 457.9 ETH worth about $1.23 million from Binance into the attacker's address, Cointelegraph reported ether swaps through THORChain, and Crypto.News said THORChain rejected Bitget's request to block the attacker addresses.
How the story developed
- Update
Bitget detects unauthorized transfers from hot wallets and freezes withdrawals
The exchange's security systems flagged transfers from some hot wallets at about 18:31 UTC on Sep. 24; trading and deposits stayed open.
- Update
Loss estimate raised from $351.6 million to about $387.5 million
Bitget said the increase came from counting more transactions in the original incident, including transfers on Zcash and Tron, and not from new unauthorized transfers.
- Official statement
Bitget publishes a staged withdrawal restart schedule
The plan put bitcoin first at 08:00 UTC on Sep. 28, then ether on Sep. 29, USDT on Sep. 30 and remaining tokens, fiat and P2P on Oct. 2.
- First report
First report by Crypto.News
Bitget to resume withdrawals in stages starting Sep. 28 after security incident
- Official statement
Official statement from Bitcoin.com News
Bitget Saga: Hacker Just Refueled on Binance as Withdrawals Reopen Monday
- Official statement
Gracy Chen holds an X AMA and Bitget reports completed withdrawals
Chen said bitcoin was restored first because that pipeline was finished first, and Bitget reported 9,585 bitcoin withdrawals totalling 4,098.036 BTC by 9 a.m. UTC.
- Update
Bitcoin withdrawals reopen at 08:00 UTC
Bitget said the flaw had been remediated and that no further unauthorized transfers had been identified after containment.
- Update
USDT withdrawals reopen as the restart nears completion
Chen said bitcoin, ether and USDT withdrawals were running and that the Protection Fund was back above $300 million, with P2P, fiat and remaining tokens due at 08:00 UTC on Oct. 2.
How coverage built up
Independent sources over time, counted the way the consensus panel counts them: a republication of a wire story does not move the line.
- 26 Sept 2026, 08:21 UTC: Crypto.News — 1 independent source, 1 reports
- 26 Sept 2026, 09:30 UTC: Bitcoin.com News, official — 2 independent sources, 2 reports
- 26 Sept 2026, 10:01 UTC: Bitcoin Insider — 3 independent sources, 3 reports
- 26 Sept 2026, 11:20 UTC: Crypto News Flash — 4 independent sources, 4 reports
- 28 Sept 2026, 10:18 UTC: Unchained — 5 independent sources, 7 reports
- 28 Sept 2026, 11:05 UTC: Cointelegraph — 6 independent sources, 10 reports
- 28 Sept 2026, 12:52 UTC: TheNewsCrypto — 7 independent sources, 11 reports
- 28 Sept 2026, 19:35 UTC: CryptoSlate — 8 independent sources, 14 reports
- 29 Sept 2026, 00:55 UTC: CoinGape — 9 independent sources, 15 reports
Affected entities
Also mentioned: Binance, Solana, Arbitrum, Base, Optimism, USD Coin, XRP
Original sources
Related events
Duelbits Confirms About $7M Hot Wallet Drain Across Four Blockchains, Site Offline
Duelbits confirmed a roughly $7M hot wallet hack on Thursday, pulled its site offline and says user funds are safe while blockchain trackers dispute the amount stolen.
Binance Wallet Adds USDT Gas Payments on BNB Chain, Ethereum, Solana and TRON
Binance Wallet now lets users pay gas fees in USDT on BNB Smart Chain, Ethereum, Solana and TRON instead of holding each chain's native token.
North Korea-linked SquidSquad suspected in $2.84M BNB Chain theft
Blockchain investigator ZachXBT attributes a $2.84 million BNB Chain theft to North Korea-linked group SquidSquad, tracing funds through Tornado Cash to Tron wallets tied to prior North Korean addresses.
Changer+ launches self-custodial stablecoin wallet across four blockchains
Changer+ released a self-custodial wallet focused on USDT and USDC across Ethereum, TRON, BNB Chain, and Solana with a launch promotion of free transactions.
Stablecoin supply reaches $300.9 billion as Tron gains and Ethereum loses ground in Q3 2026
Stablecoin supply hit $300.9 billion across 195 assets in Q3 2026, with Tron gaining $5 billion and Ethereum declining $4.9 billion.
THORChain declines Bitget request to block addresses tied to $387.5 million hack
Bitget asked THORChain to refuse service to addresses holding its stolen funds; THORChain says a network halt is not a selective freeze and it does not censor by design.
