Bitget Restarts Bitcoin Withdrawals Following $388M Security Breach

The security failure originated from a compromised third-party security product, which allowed attackers to harvest high-level internal credentials. According to CEO Gracy Chen, these credentials enabled the perpetrators to bypass existing risk controls and inject fraudulent withdrawal commands directly into the wallet infrastructure. While the breach reached a total of $387.5 million, Bitget maintains that user account balances remain untouched and that the company’s User Protection Fund—valued at over $464 million at the time of the incident—will cover the losses.

Bitget has completed a security audit and patched the specific vulnerability exploited during the September 24 attack. Mandiant and SlowMist are currently assisting with the ongoing investigation and asset recovery efforts. Following the successful restoration of Bitcoin services, the exchange has set a strict timetable for further re-openings: Ethereum withdrawals resume September 29, followed by Tether on September 30, with all remaining services expected to return by October 2.

Recovery efforts face significant technical hurdles, as attackers have already attempted to launder funds through decentralized protocols like THORChain and privacy-focused mixers such as Wasabi CoinJoin. While Circle and Tether have successfully frozen a portion of the stolen assets, much of the capital remains active across various attacker-controlled wallets. To incentivize the return of funds, Bitget has launched a bounty program offering a 5% reward for information leading to the recovery or freezing of the stolen assets.