Bitget Resumes BTC Withdrawals, Claims Third-Party Products Were Exploited
Bitget resumed Bitcoin network withdrawals as planned at 8:00 UTC on September 28, following unauthorized transfers affecting its hot and warm wallet infrastructure on September 24. The company revised its losses to approximately $387.5 million, stating that user account balances remained unchanged and were covered by the user protection fund, with trading and deposits continuing uninterrupted.
Xie Jiayin, head of the Chinese-speaking region, stated during a live event review that the attackers exploited vulnerabilities in third-party security products to steal internal network credential permissions, forging withdrawal instructions to the wallet system, allowing abnormal transfers that had passed risk checks to be executed; the attackers disguised themselves using real identities and routine operations, did not use common viruses, and ruled out private key leaks and internal collusion.
Rectifications include isolating affected servers and preserving evidence, invalidating and re-signing internal login credentials, reclaiming and splitting high-sensitivity permissions, requiring multi-person approval for key operations, notifying the security vendor, and suspending related functions until fixes are implemented, with subsequent withdrawals requiring independent verification. Investigations involve Mandiant and SlowMist.
CEO Gracy Chen stated during a community live stream that the BTC channel is operating smoothly in its initial phase. The company disclosed a timeline: ETH multi-chain will open on September 29 at 8:00 UTC, USDT multi-chain on September 30, and other tokens, fiat, and peer-to-peer on October 2. The scale of the protection fund is mentioned to cover this impact, with an internal goal to restore baseline levels.
Independent commentary attributes the attack to manipulation of backend signature flows rather than theft of cold wallet private keys. Some attack addresses are reportedly frozen. The self-custody Bitget Wallet is stated to be separate from the exchange infrastructure and unaffected.
In market mechanics, what is sold is the verification time gained from pausing withdrawals, and what is bought is the redemption rights after the multi-chain reopening. Funds are being allocated from the protection fund and hot wallets to the user withdrawal queue; beneficiaries are accounts able to withdraw Bitcoin as scheduled, while those under pressure must wait for ETH and USDT windows and the identified third-party security products. The event was driven by the forgery of hot wallet instructions rather than a rewrite of on-chain consensus.
Source: Public Information
ABAB AI Insight
This incident advances exchange security from "Are the private keys intact?" to "Who has the authority to instruct the wallet to transfer funds?" Third-party security products were supposed to block transactions before signing, but instead became an entry point to the internal network, impersonating operations. Risk control saw legitimate credentials and routine operations, allowing abnormal transfers to pass checks that should have blocked them.
The capital path is that the protection fund, accumulated from transaction fees, covers the gap in the hot wallet, keeping user account balances unchanged, while the platform uses reserves to avoid a run on funds. The multi-chain reopening queues redemption rights by asset risk: Bitcoin first, stablecoins next, and fiat last. The involvement of Mandiant and SlowMist partially outsources qualitative assessments, avoiding self-certification.
Analogous cases include similar signature chain attacks in 2025 and traditional bank instruction fraud: the keys are still in the safe, but payment instructions are rewritten. The industry phase is after the popularization of multi-party computation and cold-hot separation, where supply chain software becomes a new single point of failure. Whoever can issue "verified" withdrawals effectively holds temporary disposal rights over user assets.
Structural judgments belong to the reconstruction of the industrial chain. The mechanism is that once security products enter the internal network, the attack surface shifts from the key vault to the vendor patch cycle; exchanges use funds and time windows to price redemptions, while vendors use vulnerabilities to price the next procurement.
ABAB News · Law of Cognition
The private keys are intact, but instructions are rewritten, and money still flows.
Once security products enter the internal network, they become a new single point of failure.
The protection fund buys non-run guarantees but cannot restore the integrity of the signature flow.