Bitget restores bitcoin withdrawals after $387.5M hack

At a glance

Bitget restores bitcoin withdrawals from 08:00 UTC on 28 Sep, the first stage of a four-step reopening after the 24 Sep hot-wallet theft, according to the exchange’s published schedule.
Bitget puts the loss at about $387.5 million and says its User Protection Fund, which held more than $464 million on 24 Sep, covers it.

Bitget reopened bitcoin withdrawals at 08:00 UTC on Monday, according to the phased resumption schedule the exchange published on 26 Sep.

The schedule sets ether withdrawals on Ethereum, BNB Smart Chain, Arbitrum, Base and Optimism for 08:00 UTC on 29 Sep. Tether (USDT) on Ethereum, BNB Smart Chain, Solana and Tron follows at 08:00 UTC on 30 Sep. Other tokens, fiat and peer-to-peer withdrawals are listed for 08:00 UTC on Friday, 2 Oct. Bitget said the order applies to all users “without preference” and that deposits and trading continued throughout.

Bitget detected unauthorised transfers from some of its hot wallets at 18:31 UTC on 24 Sep, the exchange said in its first security notice. It initially estimated the loss at about $351.6 million. On 25 Sep it raised the figure to about $387.5 million after adding Zcash and Tron transfers left out of the first count, according to a later incident update.

The affected assets include XRP, ether, USDT, Zcash, USDC, USDT0, Tether Gold, BNB, AVAX and TRX, the update said. Bitget said its cold wallets were not affected. The breach reached only part of the hot-wallet and warm-wallet layers of what it calls a three-tier wallet setup.

The exchange said the vulnerability had been identified and fixed. Mandiant, part of Google Cloud, and the blockchain security firm SlowMist are supporting the investigation, the 26 Sep notice said. Bitget has not named the attacker and said on 24 Sep it would not speculate on the attack vector before the investigation ends.

Bitget has offered a bounty of 5% of any funds frozen or recovered through voluntary third-party action. It said some affected assets had already been frozen with the help of industry partners, without giving an amount.

Chief executive Gracy Chen was scheduled to host a live session on the incident at 07:30 UTC on Monday, before bitcoin withdrawals reopened, according to the 26 Sep notice.

The next stage, ether withdrawals across five networks, is due at 08:00 UTC on Tuesday, 29 Sep.

Get the week’s raises and deals in The Ledger Weekly.

Produced by the Crypto Watch Desk newsroom using AI tools. This article is for information only and is not investment advice.