Bitget resumed Bitcoin network withdrawals as planned at 8:00 UTC on September 28, following unauthorized transfers affecting its hot and warm wallet infrastructure on September 24. The company revised its losses to approximately $387.5 million, stating that user account balances remained unchanged and were covered by the user protection fund, with trading and deposits continuing uninterrupted.

Xie Jiayin, head of the Chinese-speaking region, stated during a live event review that the attackers exploited vulnerabilities in third-party security products to steal internal network credential permissions, forging withdrawal instructions to the wallet system, allowing abnormal transfers that had passed risk checks to be executed; the attackers disguised themselves using real identities and routine operations, did not use common viruses, and ruled out private key leaks and internal collusion.

Rectifications include isolating affected servers and preserving evidence, invalidating and re-signing internal login credentials, reclaiming and splitting high-sensitivity permissions, requiring multi-person approval for key operations, notifying the security vendor, and suspending related functions until fixes are implemented, with subsequent withdrawals requiring independent verification. Investigations involve Mandiant and SlowMist.

CEO Gracy Chen stated during a community live stream that the BTC channel is operating smoothly in its initial phase. The company disclosed a timeline: ETH multi-chain will open on September 29 at 8:00 UTC, USDT multi-chain on September 30, and other tokens, fiat, and peer-to-peer on October 2. The scale of the protection fund is mentioned to cover this impact, with an internal goal to restore baseline levels.

Independent commentary attributes the attack to manipulation of backend signature flows rather than theft of cold wallet private keys. Some attack addresses are reportedly frozen. The self-custody Bitget Wallet is stated to be separate from the exchange infrastructure and unaffected.

In market mechanics, what is sold is the verification time gained from pausing withdrawals, and what is bought is the redemption rights after the multi-chain reopening. Funds are being allocated from the protection fund and hot wallets to the user withdrawal queue; beneficiaries are accounts able to withdraw Bitcoin as scheduled, while those under pressure must wait for ETH and USDT windows and the identified third-party security products. The event was driven by the forgery of hot wallet instructions rather than a rewrite of on-chain consensus.

Source: Public Information