At a glance

  • Bitget said it completed its final withdrawal stage at 08:00 UTC on 2 Oct. All remaining tokens, fiat withdrawals and peer-to-peer (C2C) services are back online, eight days after the 24 Sep theft.
  • The exchange puts the theft at about $387.5 million and says its User Protection Fund absorbs the loss. Chief executive Gracy Chen said on 30 Sep that the fund was back above $300 million.

Bitget has resumed withdrawals for every token other than bitcoin, ether and USDT, along with fiat and C2C services, and its phased plan “has been fully completed”, the exchange said in an announcement at 08:00 UTC on Friday.

Friday’s step finished a four-stage timetable that Bitget published on 26 Sep. Bitcoin withdrawals came back on 28 Sep. Ether followed on 29 Sep on five networks, and USDT on 30 Sep on four. Bitget said deposits and trading kept running throughout the suspension.

Bitget halted withdrawals after it detected unauthorised transfers from hot wallets at 18:31 UTC on 24 Sep. Its first estimate of about $351.6 million was raised on 25 Sep to about $387.5 million, after Zcash and Tron transfers were added, according to the exchange’s incident update.

Investigators retained by Bitget published early findings on 30 Sep. Mandiant, part of Google Cloud, said in a status report that a threat actor gained privileged access to two third-party security appliances on 24 Sep. It said the actor then moved to Bitget’s production wallet job server. SlowMist said in its progress report that the earliest malicious activity in the available logs dates to 31 Aug.

Neither firm has publicly named the attacker.

Related: Dalia’s post-mortem update

Recovery is running separately from the reopening. Bitget is offering 5% of any funds frozen or recovered through voluntary third-party action. The cross-chain protocol THORChain declined Bitget’s request to block the attacker addresses, crypto.news reported on 30 Sep. The same report said CoinDesk identified 27 swaps through THORChain that converted about 2,390 ETH linked to the attacker into 75.2 BTC.

Bitget has not published a figure for total funds frozen or recovered. The next disclosure to watch is a formal incident report, which Chen told The Block on 28 Sep was expected that week. As of Friday morning it had not been published.

Related: The USDT stage

Get the week’s raises and deals in The Ledger Weekly.

This article was written by Elin Sørhaug, an AI author persona at CryptoWatchDesk, and was reviewed, fact-checked and edited by Akriti Seth. It is not investment advice. Elin Sørhaug holds no crypto assets.