Bitget Reopens Bitcoin Withdrawals After $387.5M Hack

BitcoinWorld

Bitget Reopens Bitcoin Withdrawals After $387.5M Hack

Bitget reopened Bitcoin withdrawals on the Bitcoin network at 08:00 UTC on September 28, 2026, four days after the exchange halted customer withdrawals in the wake of a breach that moved approximately $387.5 million to attacker-controlled addresses. According to Crypto.news, BTC withdrawals on the BNB Smart Chain also reopened, with the exchange describing the move as the first step in a phased restoration of services.

Key facts

• Bitget detected unauthorized transfers from portions of its hot and warm wallet infrastructure at approximately 18:31 UTC on September 24, 2026.
• The exchange initially estimated roughly $351.6 million affected, then revised the total to about $387.5 million after tracing additional transfers on Zcash and Tron.
• ETH withdrawals are scheduled for 08:00 UTC on September 29 across Ethereum, BNB Smart Chain, Arbitrum, Base and Optimism, followed by USDT on September 30 across Ethereum, BNB Smart Chain, Solana and Tron.
• Mandiant and blockchain security firm SlowMist are assisting the investigation, and Bitget published attacker addresses alongside a tracing portal.
• Circle and Tether had frozen approximately 99,990 USDC and 218,023 USDT linked to the attack by September 26, according to reporting by Crypto.news.

How the breach unfolded and how Bitget is restoring access

During a September 28 livestream, CEO Gracy Chen said the attacker exploited a vulnerability in a third-party security product and obtained high-level internal network credentials. Bitget said those credentials were then used to send fraudulent withdrawal commands to the wallet system that bypassed existing risk controls. The exchange maintains that no private keys leaked and cold wallets were untouched, and that the underlying vulnerability has since been patched.

The rollout carries no special treatment for large clients. Speaking at a Monday ask-me-anything session, Chen said the schedule applies to all users, with no priority access for institutions, VIP customers or Bitget employees, according to Cointelegraph. She said BTC came back first because “the withdrawal pipeline is the first to be completed,” adding that ETH and USDT would follow as security checks progress.

Remaining token withdrawals, fiat withdrawal services and peer-to-peer transactions are scheduled to return at 08:00 UTC on October 2. Bitget has said every stage of the restart remains subject to security checks for the relevant asset and network.

The frozen funds, the bounty and an unresolved question for THORChain

Recovery efforts are running in parallel with the service restoration. Bitget has launched a bounty program offering separate 5% rewards tied to qualifying freezes and successful recoveries of stolen assets. Compliance firm AMLBot estimated on September 25 that roughly $343 million associated with the breach remained dormant across 13 attacker wallets, including eight Ethereum wallets holding about 68,300 ETH, four XRP addresses containing around 83 million XRP, and a wallet holding close to 18,900 ZEC.

Some of the stolen assets have continued moving. Blockchain analytics firm Lookonchain reported Monday that the attacker was swapping Ether for Bitcoin through THORChain, as Arkham data showed ETH linked to the attacker flowing into THORChain vaults. Chen has called on the decentralized cross-chain protocol to refuse services to addresses tied to the attack.

THORChain pushed back the same day, stating that its network halt is an emergency security mechanism that affects the protocol broadly and “is not a selective freeze of specific funds or an individual swap.” Crypto author Anndy Lian, cited by Cointelegraph, noted that the protocol has no built-in address blacklist, limiting any ability to block specific wallets. Separate reporting by Crypto.news said AMLBot later traced roughly four BTC connected to the stolen funds into a Wasabi CoinJoin transaction, with those funds moving from TRON through USDT0 and Ethereum before being converted via THORChain into Bitcoin.

Why it matters

The breach sits among the larger exchange incidents of 2026 and tests whether a platform can restore user confidence while large sums are still being traced across chains. Because deposits and trading never stopped, affected customers could still access markets; the four-day freeze on withdrawals was the main disruption they experienced, and Bitget’s decision to let its User Protection Fund absorb the loss shifts the immediate financial burden away from users.

The dispute with THORChain is the more durable issue for the industry. It exposes a structural gap between what compliance teams can ask permissionless infrastructure to do and what permissionless infrastructure is designed to deliver, a tension that will shape how exchanges handle cross-chain tracing long after this particular schedule completes.

What to watch

Ether withdrawals at 08:00 UTC on September 29 and USDT withdrawals on September 30 are the next checkpoints, with all remaining assets, fiat services and peer-to-peer functionality due back on October 2. Those dates are conditional on per-asset and per-network security checks, so any further slippage would signal that the restored withdrawal pipeline is not yet running cleanly.

This post Bitget Reopens Bitcoin Withdrawals After $387.5M Hack first appeared on BitcoinWorld.