On the morning of September 28, four days after halting all withdrawals, Bitget began resuming Bitcoin withdrawals. ETH withdrawals are scheduled for September 29, USDT for September 30, and other tokens, fiat, and direct user trading services are set to return on October 2.
Bitget stated that the attacker did not need to steal private keys to withdraw funds. They found a vulnerability in a third-party security product, through which they obtained high-level internal credentials, and then used those credentials to issue fraudulent withdrawal requests to the exchange’s wallet system, bypassing existing risk control mechanisms.
Four Days, Three Figures
The scale of the losses grew with each audit cycle. Bitget initially announced approximately $351.6 million, a figure that remained unchanged for four days. After reconciling on-chain flows, the estimated loss was revised up to roughly $388 million, and the exchange clarified that this updated figure does not reflect any new unauthorized transactions.
Funds were transferred across multiple networks, including Ethereum, the XRP Ledger, and Tron. This explains why tracing is far more difficult than in an incident affecting only a single chain.
The processing speed was also noteworthy. BTC withdrawals opened at 08:00 UTC on September 28 on the Bitcoin and BSC networks, and by 09:00 UTC—just one hour later—Bitget had processed 9,585 withdrawal requests totaling around 4,098 BTC. The exchange’s User Protection Fund of over $464 million remains intact, surpassing the $388 million loss, and the platform affirmed that user account balances are unaffected.
The Lesson Lies in Processes, Not Optics
This was a different kind of attack from past depictions of exchange hacks. Under the traditional approach, exchanges argue that private keys stored in cold wallets are the core defense, so attackers must obtain those keys. This time, the attacker compromised the transaction approval process itself. The private keys and cold wallets remained intact; there was simply no mechanism in place to stop the withdrawal orders from going through.
Bitget described this as the first time in eight years an attack had breached the exchange’s infrastructure. A line in the official announcement noted that this track record does not diminish the severity of the incident, but rather sets the standard by which the exchange’s response must now be judged.
Regarding the investigation, the exchange said it is coordinating with industry stakeholders, a portion of the assets has been frozen, and a security report will be published during the week. CEO Gracy Chen previously stated that the attack methodology is consistent with North Korea-linked groups, though the investigation remains ongoing.
The takeaway to watch: an exchange with solid security processes can still have credentials compromised through a third-party vendor. The practical question for other exchanges is not whether their wallets are secure, but whether their transaction approval pipelines are exposed to similar vulnerabilities.