The cryptocurrency exchange Bitget has restarted Bitcoin withdrawals four days after unauthorized transfers totaling approximately $387.5m were made from part of its hot and warm wallet infrastructure.
Withdrawals on the Bitcoin network reopened at 08:00 UTC on September 28 after additional security checks.
Bitget's September 26 withdrawal update said the vulnerability behind the incident had been identified and remediated, while its investigation with Mandiant and blockchain security firm SlowMist continued.
Bitget Traces Breach to Third-Party Security Product
The incident was detected on September 24, when Bitget's security systems flagged unauthorized transfers from some of its hot wallets. The exchange initially estimated the affected amount at $351.6m before revising the figure to approximately $387.5m after further transaction classification identified additional affected Zcash and TRON transfers.
Bitget said the revision did not represent additional unauthorized transfers after the incident was contained. The exchange added that its cold wallets were unaffected and that user account balances remained intact.
The withdrawal suspension was introduced as a security measure while Bitget examined the withdrawal infrastructure. Trading and deposits continued during the pause.
The exchange said its investigation had identified the attack path and the underlying vulnerability had been fixed.
In a September 28 statement on X, Bitget said a flaw in a third-party security product gave the attacker high-level internal credentials, which were then used to send fraudulent withdrawal commands that bypassed its risk controls.
Bitget said the loss falls within the coverage of its Protection Fund, which its first incident notice valued at more than $464m.
Ether and Tether Withdrawals Next as Recovery Continues
Bitget's September 26 schedule restores the remaining services in three further phases, each opening at 08:00 UTC. Ether (ETH) is next on September 29, on Ethereum and on the BNB Smart Chain, Arbitrum, Base and Optimism networks.
Tether (USDT) follows on September 30 on Ethereum, BNB Smart Chain, Solana and TRON, with all other tokens, fiat withdrawals and peer-to-peer (P2P) services set for October 2.
Read more on cryptocurrency theft: North Korean Attackers Hit 30,000 Devices and Steal $10.7m
Bitget said the incident remains contained and that no further unauthorized transfers are possible. It also said Mandiant and SlowMist continued to support the investigation, including forensic analysis and tracing of affected funds.
The exchange has launched a recovery bounty program and said it was coordinating with law enforcement, blockchain security firms and other industry participants to trace and recover affected assets. It said some affected assets had already been frozen.
Bitget's investigation has not concluded, meaning details about the attacker's identity and the full extent of the compromise remain subject to further findings. The exchange has said private-key compromise was ruled out based on the investigation to date, and that it would review how it assesses and deploys third-party security products.