TLDR
Crypto exchange Bitget is restoring withdrawals in phases after a roughly $388 million hot wallet exploit, while claiming user balances will be fully covered by its protection fund.
- Bitget paused withdrawals after a 24 September breach and is now resuming BTC, ETH and USDT withdrawals on a set timetable across major networks.
- The hack exploited a third?party security product, but Bitget says private keys, cold wallets and customer balances are intact, with losses covered by a large protection fund.
- Ongoing forensic work, a promised security report and continued tracing of stolen assets are key signals to watch for trust in Bitget and centralized exchanges more broadly.
Deep Dive
1. Timeline Of Hack And Withdrawal Restart
On 24 September, attackers used stolen internal credentials from a third?party security product to issue fraudulent withdrawal commands from Bitgets hot and warm wallets, draining about $388 million in crypto across several chains, including Ethereum, Tron, BNB Chain and Avalanche, while cold wallets remained untouched.Bitget exploit overview
Bitget suspended withdrawals, then began a phased restart: Bitcoin (BTC) withdrawals on the Bitcoin network and BNB Smart Chain resumed at 08:00 UTC on 28 September, with Ethereum (ETH) withdrawals due on 29 September and Tether (USDT) withdrawals on 30 September.Phased withdrawal schedule
All remaining assets, fiat withdrawals and peer?to?peer services are scheduled to be back by 2 October if chain?specific security checks pass.Full service restoration plan
2. User Impact And Security Measures
Bitget states that user account balances and private keys were not compromised and that the theft was limited to infrastructure that authorizes withdrawals, not the underlying key storage.Attack path explanation
To absorb the loss, the exchange is relying on a User Protection Fund holding more than $464 million and about 5,500 BTC, with a reported reserve ratio of 127 percent, and has committed to replenishing the fund above its target level.Protection fund details
External security firms Mandiant and SlowMist are validating the fixes and tracing stolen funds; stablecoin issuers have already frozen some USDC and USDT linked to the attacker addresses.Forensic and recovery efforts
Operational risk at centralized exchanges persists even when user balances are made whole, so custody diversification and monitoring of official security updates are important.
3. Signals To Watch Next
Bitget has promised an official security report detailing the vulnerability, attack path and remediation, which will be an important test of how transparent it is and how robust its new controls look.Security report commitment
Investigators and Bitget have hinted at a sophisticated possibly state?linked actor, but attribution is unconfirmed; ongoing tracing shows stolen ETH and BTC moving through privacy tools like THORChain and CoinJoin.Hacker behavior and tracing
Beyond Bitget, regulators and other exchanges are likely to scrutinize third?party security dependencies and wallet authorization flows, which could lead to tighter standards for centralized platforms serving retail users.
Confidence in Bitget and similar exchanges will depend on clear post?mortems, evidence of stronger controls, and how effectively stolen funds are frozen or recovered.
Conclusion
Bitgets resumption of withdrawals after a roughly $388 million exploit shows that a large protection fund and rapid remediation can limit direct user losses, but it also highlights how complex, credential?based attacks can bypass traditional key security. For crypto users, the episode reinforces the need to treat centralized exchanges as both trading venues and significant counterparty risks, and to watch closely how Bitget and peers upgrade their security practices in the weeks ahead.
CoinsKid.Com