Major Exchange patches vulnerability and restores withdrawals

TLDR

Bitget, a major crypto exchange, has patched a security vulnerability and started restoring withdrawals in phases after an exploit that stole about 380 million dollars in crypto.

1. Bitget says attackers abused a flaw in a third-party security product to forge withdrawal commands, but the vulnerability is now patched and the incident contained.
2. User balances, private keys and cold wallets were reportedly unaffected, and Bitgets protection fund plus proof of reserves are covering all losses.
3. Withdrawals are reopening chain by chain over several days, so users should expect staggered access and watch for the final security report and full service restoration.

Deep Dive

1. How The Exploit Happened And Was Fixed

Reporting from The Block and TokenPost says the attack began on 24 Sep when unauthorized transfers from Bitgets hot and warm wallets moved roughly 380 to 388 million dollars in assets across multiple networks, including Ethereum, BNB Chain, Avalanche and others.Bitget begins phased withdrawal resumption

Bitget states that hackers exploited a zero-day vulnerability in a third-party security product, stole high-level internal credentials, and used them to send forged withdrawal commands that bypassed normal risk checks.Bitget CEO explains third-party flaw

The exchange now says it has isolated affected systems, fixed the vulnerability, invalidated and reissued internal credentials, restructured high-sensitivity permissions, and added independent verification requirements for future withdrawals.Bitget completes vulnerability repairs Security firms Mandiant and SlowMist are assisting ongoing investigation and hardening efforts.Bitget hack investigation support

Confidence: high, because multiple detailed incident timelines and CEO statements align on cause, scope and remediation.

2. User Balances, Coverage And Risk

Bitget repeatedly emphasizes that private keys were not compromised and cold wallets and user balance records were unaffected. The exploit targeted the withdrawal command path, not key storage.Bitget incident timeline and key-safety note

Losses, estimated around 380 to 388 million dollars, are being covered by a dedicated user protection fund that Bitget says totals about 464 million dollars and will be replenished back to at least 300 million within a week.Bitget protection fund to cover losses

Bitget also points to publicly disclosed proof of reserves showing around 127 percent coverage, arguing that the withdrawal pause was about security verification, not solvency.Bitget fund and proof-of-reserves overview

3. Phased Withdrawal Resumption And What To Watch

Bitcoin (BTC) withdrawals have already resumed, with Bitget restoring access chain by chain as each network completes repair and security validation.Phased BTC-first withdrawal restart

According to Bitgets schedule, ETH withdrawals on major EVM networks follow, then USDT on several chains, with all remaining tokens, fiat withdrawals and P2P services targeted to reopen by early October.Detailed multi-chain withdrawal timeline

Key next signals to watch are: 1) all chains clearing security checks without new incidents, 2) publication of the promised formal security report, and 3) any industry-wide reaction to third-party security product risk, which could lead to tighter standards across exchanges.

Conclusion

Bitgets exploit shows how a single third-party security flaw can translate into very large unauthorized transfers even when private keys and cold storage remain safe.

The combination of a sizeable protection fund, strong proof of reserves and transparent incident timelines reduces direct loss risk for users, but the staged withdrawal reopening underlines that operational access, not just solvency, is critical.

For crypto users, this episode reinforces the value of monitoring exchange status updates, understanding how funds are protected, and avoiding overreliance on any single venue for custody and liquidity.