Bitget begins withdrawal restart as security checks continue after exploit

Bitget has begun restoring withdrawals following the September 24 security incident, starting with bitcoin as the exchange works through a phased recovery. The September 28 restart is a step toward restoring customer access, but it should not be confused with every asset and network returning to normal at once.

The exchange’s published recovery schedule assigns separate stages to BTC, ETH, USDT and remaining services. Bitget confirmed that Bitcoin-network withdrawals began at 08:00 UTC on September 28 in a statement reported by The Block. The exchange says the vulnerability has been patched and its protection fund will cover losses. Those are company assurances; a completed restoration and a final accounting remain separate milestones.

Access returns one service at a time

For customers, a phased restart means the asset name alone may not tell the whole story. A token can be available across several networks, each with a different withdrawal route. The relevant information is the status of the particular asset and network selected in the account, not a general headline that withdrawals are back.

The published timetable points to further stages after the bitcoin restart. Such dates are operational targets, and live status can change as checks proceed. A scheduled opening is not proof that an individual request has cleared screening, entered a processing queue or appeared on the destination chain. These are distinct stages of a withdrawal.

A transaction identifier provides a way to check an onchain transfer once it has been broadcast. Before that point, the exchange’s account interface and support records are the relevant evidence. Repeatedly submitting new requests without understanding the status of an existing one can make a confusing situation harder to reconcile.

Recovery has more than one measure

Restoring a withdrawal endpoint is only part of incident recovery. An exchange also needs confidence in access controls, transaction authorization and the accuracy of internal balances. A platform can have assets available while still limiting movement during checks, just as a working blockchain does not establish that an exchange’s own systems are ready.

The size of an exploit can also be reported differently as investigators reconcile assets and valuation times. The Block described approximately $388 million in the September 24 incident. That figure should not be treated as a final customer-loss calculation. The amount transferred by an attacker, the amount recovered and the eventual cost borne by a company are different quantities.

TBJ’s earlier examination of the Triple-A wallet breach highlights why the affected balance sheet matters. A loss from corporate assets is not automatically a deduction from every customer account, but a platform’s statement about coverage still needs to be distinguished from independent confirmation of how the incident has been resolved.

The danger of a second incident

Disrupted withdrawals create an opening for impersonation. A message offering priority processing, a refund form or a special recovery wallet can look plausible when customers are waiting for access. The useful test is whether an instruction appears through a verified official channel and matches the normal account process.

An exchange withdrawal does not require sending a wallet seed phrase to a support agent. Nor does an unsolicited request to transfer assets elsewhere become trustworthy because it refers to a real incident. These are basic boundaries that remain relevant even when the underlying service disruption is genuine.

For businesses holding operational balances, the incident is also a reminder that liquidity is not solely a question of market price. Funds can be economically valuable yet temporarily unavailable for a payment. Treasury planning therefore has to consider access, settlement routes and concentration at individual service providers, rather than assuming that a liquid trading pair guarantees immediate movement of funds.

The next test is sustained operation

The most useful follow-up will be the completion of the remaining withdrawal stages, a detailed incident explanation and evidence that customer requests are clearing consistently. A restart announcement cannot answer every question about the initial compromise, and attributing the attack requires more evidence than the fact that funds moved through particular addresses.

For now, Bitget’s bitcoin restart marks progress in a recovery that is still unfolding. Customers should judge it by the specific service they need and the status of their own request. For the wider market, the episode reinforces a familiar distinction: uninterrupted blockchain operation and dependable access through a centralized exchange are not the same thing.