Bitget reopened Bitcoin withdrawals at 08:00 UTC on September 28, the first stage of a phased restart and the first time customers have been able to move funds off the exchange since it froze withdrawals four days earlier.
The reopening followed the schedule the exchange published on September 26. BTC withdrawals on the BNB Smart Chain network opened later the same day. Bitget said the resumption came after additional security work across its withdrawal infrastructure, that the vulnerability has been remediated, that no further unauthorized transfers have been identified since containment, and that user account balances remain unaffected.
What the Investigation Found
Bitget also gave its most specific account yet of how the attack worked, following a live question-and-answer session hosted by chief executive Gracy Chen.
The investigation found that the attacker exploited a vulnerability in a third-party security product used by Bitget to obtain high-level internal credentials, the exchange said. The attacker then used those credentials to send fraudulent withdrawal commands to the wallet system, causing it to execute abnormal transfers that bypassed risk controls—an account consistent with earlier findings that $185 million moved in a single minute without private keys being stolen.
Private keys were not compromised and cold wallets were not affected, Bitget said, repeating what it has maintained since the incident. It said it has identified the attack path, remediated the vulnerability, and contained the incident.
Recovery Efforts Continue
Mandiant and SlowMist continue to support the investigation and on-chain tracing. Bitget said it has published the identified attacker addresses and related tracing data to support industry collaboration and asset recovery.
Not every avenue has been open to it. THORChain node operators rejected Chen’s request to block wallets associated with the stolen funds, a decision rooted in the protocol’s permissionless design.
The exchange said it expects to complete an internal security report this week and will share further findings as they are verified.
Under the published schedule, ETH withdrawals are due at 08:00 UTC on September 29 across Ethereum, BNB Smart Chain, Arbitrum, Base, and Optimism; USDT at the same time on September 30 across Ethereum, BNB Smart Chain, Solana, and Tron; and remaining tokens, fiat services, and peer-to-peer (P2P) transactions on October 2.
Bitget said the September 24 incident is the first security incident of this nature affecting the exchange in eight years of operation.
Also Read: Is Bitget the Next FTX? What the $387.5 Million Hack Does and Doesn’t Have in Common
