Major Exchange resumes withdrawals after $388M breach

TLDR

Bitget has begun restoring withdrawals after a roughly $388 million security breach, easing near term fears about user balances but raising serious questions about its security model and future flows.

1. Attackers exploited a third party security product on 24 Sep to issue fake withdrawals, moving about $387.5$388 million from Bitgets hot and warm wallets while cold wallets stayed intact.
2. Bitget is reopening withdrawals in phases, starting with Bitcoin and then ETH and USDT, and says customer balances are fully covered by a protection fund of over $464 million.
3. Users should watch the staged reopening through early October, on chain movements of stolen funds, and any evidence of deposit flight or regulatory scrutiny that could affect Bitgets role in the market.

Deep Dive

1. How The $388M Breach Happened

Reports say Bitget detected abnormal transfers on 24 Sep from its hot and warm wallets across multiple networks, later revising estimated losses from $351.6 million to about $387.5$388 million as Zcash and Tron movements were included. One detailed summary describes two rapid waves of transfers totaling around $290 million within 24 seconds, with further related activity afterward.

Bitget and multiple outlets state that attackers abused a vulnerability in a third party security product to steal high level internal credentials and send forged withdrawal commands, bypassing normal risk controls, while private keys and cold wallets were not compromised. Follow up coverage confirms this pattern and frames it as an infrastructure breach rather than a key theft.

2. Withdrawal Resumption And User Fund Protection

Bitget has restarted Bitcoin withdrawals on the Bitcoin and BNB Smart Chain networks at 08:00 UTC on 28 Sep, with ETH withdrawals scheduled for 29 Sep and USDT on 30 Sep across major networks such as Ethereum, BNB Smart Chain, Solana and Tron. Several sources note that all remaining crypto, fiat and peer to peer services are planned to be fully restored by 2 Oct, subject to per asset security checks, in a phased rollout that applies equally to retail, VIP and internal accounts. One timetable is laid out in this TradingView recap.

Bitget says its User Protection Fund, reported at over $464 million with a reserve ratio around 127 percent, will absorb the losses, and external articles consistently report that user balances remain unaffected. Crypto.news summary and others repeat this assurance.

3. Risks, On Chain Tracing, And What To Watch

The attacker continues to move stolen assets, including swapping ETH to BTC via THORChain, which complicates recovery efforts according to Cointelegraphs coverage. Forensics firms Mandiant and SlowMist are assisting Bitget, and some funds have already been frozen by issuers such as Circle and Tether, but most of the roughly $387.5 million remains at risk.

For users and market observers, key signals include:

1. Whether Bitget maintains full uptime and normal throughput as each withdrawal phase reopens.
2. On chain evidence of large outflows from Bitget after withdrawals resume, which would point to confidence loss and possible liquidity stress.
3. Any regulatory or law enforcement commentary, especially if suspicions of a state backed attacker are strengthened.

Conclusion

Bitgets phased reopening of withdrawals and commitment to cover the roughly $388 million loss reduce immediate user balance risk, but the breach highlights structural weaknesses in exchange backend security and vendor dependencies. The ultimate impact on Bitget will depend on whether it can sustain withdrawals without disruption, rebuild trust faster than deposits leave, and support its assurances with transparent security reporting and successful asset recovery efforts.