Major Exchange resumes BTC withdrawals after hack

TLDR

Bitget has restarted Bitcoin (BTC) withdrawals after a roughly $388 million security breach, beginning a phased restoration of services.

1. The Sept 24 exploit drained about $387388 million from Bitgets hot and warm wallets, and BTC withdrawals resumed on Sept 28 after security checks.
2. Bitget says user balances and cold wallets were not affected and that a protection fund and 127 percent reserves will fully cover losses, limiting systemic impact.
3. Withdrawals for Ether, Tether and other assets are scheduled over the coming days, while investigators track the hackers funds and Bitget prepares a detailed security report.

Deep Dive

1. Exploit And Withdrawal Resumption

On Sept 24, attackers exploited a vulnerability in a third party security product used by Bitget, stole high level internal credentials and issued forged withdrawal commands that bypassed risk controls, moving about $387.5388 million across multiple chains including Ethereum, Tron, XRP and Zcash. This is described as one of the largest crypto exchange hacks this year in a statement summarized by The Block.

Bitget responded by pausing all withdrawals and isolating affected wallets, while deposits and trading continued. After patching the vulnerability and running extra checks, the exchange reopened Bitcoin withdrawals on the Bitcoin network at 08:00 UTC on Sept 28 as the first step in a phased rollout. Coverage from Crypto.news and Cointelegraph notes that BTC withdrawals on Bitcoin and BNB Chain came first, with Ether (ETH) set for Sept 29 and Tether (USDT) for Sept 30, followed by remaining assets, fiat withdrawals and peer to peer trading by Oct 2.

2. User And Market Impact

Bitget states that private keys were not compromised and that cold wallets and user account balances remained intact throughout the incident. Losses from the hack are to be absorbed by its User Protection Fund, which holds thousands of BTC and is valued at more than 464 million dollars, and by reserves that reportedly cover customer assets at roughly 127 percent. These assertions appear consistently in Bitgets statements as relayed by outlets such as The Block and Crypto.news.

For Bitget customers, the main immediate risk was loss of access while withdrawals were paused rather than a direct haircut on balances. For the broader market, the episode is notable as an operational shock rather than a solvency crisis. Bitcoin trading and price action around the event remained driven mostly by wider market flows, and coverage on OneBullEx explicitly notes that the withdrawal pause matters only for balances held on Bitget, not for BTC generally.

3. What To Watch Next

The main near term signal is whether Bitget delivers its timetable without new incidents. On track BTC withdrawals, followed by ETH and USDT and then all assets and fiat by early October, would support its claims that the vulnerability is contained and remediation is complete. Delays or repeated pauses would be a clear warning sign for users.

Investigations by firms like Mandiant and SlowMist, described in Bitgets statements and reported by The Block, aim to trace stolen funds and produce a technical incident report. Some stablecoins linked to the attack have already been frozen by issuers, while other assets have been moved or swapped through THORChain and privacy tools according to Crypto.news and Cointelegraph. Legal and regulatory responses, plus any confirmation of who is behind the attack, could follow once that report is public.

Conclusion

Bitgets decision to reopen Bitcoin withdrawals marks a critical step in recovering from a very large wallet exploit, signaling that its infrastructure has been patched and audited sufficiently to resume limited flows. Because user balances are claimed to be fully covered and reserves remain strong, the incident looks more like an operational failure than a systemic solvency problem. The key question now is whether Bitget can sustain normal withdrawals across all assets and produce a transparent security report, which will shape how both its own users and the wider crypto market assess exchange risk in the months ahead.