Major Exchange plans Monday reopening after hack

TLDR

Crypto exchange Bitget plans to start reopening withdrawals on Monday after its recent multi-hundred-million-dollar hack, beginning with Bitcoin and then expanding to other assets in phases.

1. Bitget suffered a roughly $350388 million breach in its hot and warm wallets, but says all user balances are covered by its protection fund.
2. Official notices outline a phased restart: Bitcoin withdrawals first on Monday, followed by major networks and stablecoins over the rest of the week.
3. Users should treat this as partial recovery, watch for delays or new findings in the investigation, and reassess centralized exchange custody risk.

Deep Dive

1. Scale And Mechanics Of The Breach

On September 24, Bitget detected unauthorized transfers from parts of its hot and warm wallet infrastructure, with losses initially estimated at $351.6 million and later revised to about $387.5 million as more chains were counted. Reports describe a compromise of a backend wallet system that allowed attackers to spoof transaction data and trigger legitimate authorization flows, rather than stealing private keys or draining cold storage.

Bitget states that its User Protection Fund, holding over $464 million in verifiable assets, fully covers the loss and that customer account balances remain accurate, while trading and deposits continue as normal. Investigators have linked attack patterns and IP data to North Koreaassociated groups such as Lazarus, but attribution is still described as very likely rather than formally confirmed.

2. Monday Reopening Plan

After several days of frozen withdrawals, Bitget has published a withdrawal timetable. According to multiple reports, Bitcoin withdrawals on the Bitcoin network are scheduled to resume at 08:00 UTC on Monday, September 28 as the first step in a phased reopening, prioritizing BTC as the flagship asset.

Following that, Ether withdrawals are set to restart on September 29 across Ethereum and major EVM networks, and USDT withdrawals on key chains like Ethereum, BNB Smart Chain, Solana, and Tron are slated for September 30, with broader token withdrawals, fiat services, and peer-to-peer functions targeted by early October. This schedule reflects Bitgets stance that the underlying vulnerability has been identified and patched, but that full reopening requires staged security checks across assets and networks.

3. User Impact And Security Lessons

For Bitget customers, the key short-term impact is liquidity timing rather than balance loss: funds are claimed to be intact, but access has been delayed and will come back unevenly by asset and network. There is also residual uncertainty while investigators and firms like Mandiant and SlowMist complete their review and while recovery efforts, blacklisting, and bounty programs attempt to claw back stolen funds.

More broadly, the incident underscores the structural risk of centralized custody, even for large, seemingly well-prepared exchanges. Hot and warm wallets remain attractive targets, and protection funds shift risk from solvency to operational execution and transparency.

Conclusion

Bitgets planned Monday reopening marks a cautious step from crisis containment toward normal operations, but it does not erase the underlying security event. The phased timeline, ongoing investigation, and recovery attempts are the critical signals to watch when judging both Bitgets resilience and the wider security posture of centralized exchanges.