Bitget USDT Withdrawals Due Sept 30 After Record $463M Outflow, Reserves at 131%

Cryptocurrency exchange Bitget is scheduled to reopen withdrawals of Tether (USDT), the largest dollar-pegged stablecoin, at 08:00 Coordinated Universal Time (UTC) on Wednesday, September 30, six days after attackers moved about $387.5 million out of its internet-connected wallets. 

The restart comes after customers withdrew a net $463 million from the platform in a single day, while the exchange’s latest Proof of Reserves (PoR) report shows it holding 131% of the assets it owes users.

The figures measure different things. The reserve report compares assets held against customer balances at one point in time. The outflow figure records what customers did once withdrawals reopened. The on-chain balance of the User Protection Fund, Bitget’s emergency reserve for covering user losses, shows how much of that buffer has been spent to absorb the theft.

USDT Restart Is the Third of Four Withdrawal Phases

Bitget published its phased withdrawal timetable on its support center at 03:55 UTC on September 26.

Bitcoin withdrawals opened on schedule at 08:00 UTC on September 28, and Ether followed at 08:00 UTC on September 29. The Crypto Times earlier published the full withdrawal schedule after the exchange announced it.

Bitget said that as of 09:00 UTC on September 29, ETH inflows stood at about 9,674 ETH against outflows of about 9,023 ETH, a net inflow of roughly 651 ETH on that asset. Chief Executive Officer (CEO) Gracy Chen repeated the net-inflow figure on X.

Record Net Outflow Follows the Reopening

A platform-wide measure tells a different story. Bitget recorded about $463 million in net outflows in the 24 hours into Tuesday, September 29, Bloomberg reported. DeFiLlama, a data aggregator that tracks on-chain balances of crypto platforms, classed it as the largest one-day net outflow it has recorded for Bitget since it began tracking exchange proof-of-reserves data about four years ago.

Bloomberg put Bitget’s remaining reserves at about $5.7 billion. The one-day outflow equals roughly 8% of that figure.

The two readings are not contradictory. ETH can post a net inflow over a short window while the platform as a whole records a net outflow once Bitcoin and other unlocked assets are counted. The ETH figure comes from Bitget’s own operational update. The $463 million figure is Bloomberg’s reporting based on flow data after withdrawals reopened.

131% Reserve Ratio Across 19 Assets

A Proof of Reserves report is a disclosure in which an exchange shows the crypto assets it holds against the balances it owes customers. A reserve ratio of 100% means assets match liabilities one to one. Bitget’s 47th Proof of Reserves report, dated Victoria, Seychelles, September 30, 2026, is based on a snapshot taken at 09:00 UTC on September 29. It is the first published snapshot since the breach.

Overall coverage stands at 131%, and all 19 assets remain above 100%. The previous monthly report, Issue 46, used a mid-September snapshot and showed 135% after Bitget expanded coverage from four assets to 19. The latest ratio is 4 percentage points lower. Bitget has published monthly reserve reports since December 2022. 

Users can confirm that their own balances were included through Merkle Tree verification, a cryptographic method that lets each customer check their entry without exposing other accounts.

Chen, quoting the official PoR post, wrote on X at 16:41 UTC on September 29: “We have never touched customer funds, which is why, even after this incident, our reserve ratio remains above 131%. That’s not a coincidence. It’s many years of discipline.”

The statement describes where the coverage came from. It is not an audit of liabilities outside the snapshot. A reserve report does not, on its own, show whether the protection fund is intact, whether related-party exposures exist, or how much withdrawal pressure the exchange can meet in the future. Those limits have framed comparisons between Bitget and FTX, the exchange that collapsed in November 2022.

Protection Fund Falls Below $200 Million

When the breach was disclosed, Bitget said the User Protection Fund held more than $464 million and that the loss fell within that coverage. The fund launched in 2022 with a $300 million commitment and has been described as backed in part by 5,500 BTC, so its dollar value moves with the price of Bitcoin.

The fund has now fallen below $200 million, based on the three wallet addresses Bitget cites as its source, Bloomberg reported on September 29. That is a decline of more than $264 million, or over 57%, from the level cited at disclosure. Chen told Bloomberg by email that the fund “is being used to absorb the financial impact of the incident.” Bitget has said it will replenish the fund.

The reserve report does not state how much has been spent, how the remaining balance splits between BTC and stablecoins, or when replenishment will happen. The drawdown does not indicate that customer ledger balances are wrong. It does mean the additional safety layer is thinner than the figure customers were given on September 24 and 25.

How the September 24 Breach Unfolded

Bitget’s security systems flagged unauthorized transfers from parts of its hot and warm wallets at 18:31 UTC on September 24. Hot wallets are connected to the internet to process routine withdrawals. Warm wallets sit between hot wallets and offline cold storage.

The first two transfers, 0.84 ETH and 93 TRON (TRX), fell below the exchange’s risk-control threshold. Large transfers began at 18:58 UTC. Between 18:58 and 21:23 UTC, the attacker initiated 17 large withdrawals across Ethereum, the XRP Ledger, Zcash, BNB Smart Chain, Base, Arbitrum, Optimism and Avalanche.

Bitget said its reconciliation system flagged a discrepancy at 19:05 UTC, seven minutes after the first large transfer, and that platform-wide user withdrawals were then blocked. Funds continued leaving the affected wallets until 21:23 UTC. An independent review by blockchain security firm GoPlus Security, published September 26, placed the largest wave at about $185 million in roughly one minute around 19:16 UTC, including 13,966 ETH on Ethereum, about 91.4 million XRP and 20.6 million TRX.

Bitget’s first estimate of the loss was $351.6 million. On September 25, the exchange raised the figure to about $387.5 million after tracing additional Zcash (ZEC) and TRX transfers from the same attack window. The revision did not reflect a second breach.

According to Bitget, the attacker exploited a vulnerability in a third-party security product, obtained high-level internal credentials, and injected fraudulent withdrawal commands into wallet backend systems, which treated them as legitimate. Chen has said private keys for cold, hot, and warm wallets were not stolen and that user withdrawal requests were not forged. 

Cold storage and Bitget Wallet, the separately operated self-custody wallet app, were not affected. Bitget engaged Mandiant, the Google Cloud incident-response unit, and blockchain security firm SlowMist, and notified law enforcement.

Chen has said IP address behavior and on-chain patterns resemble earlier operations linked to North Korea, formally the Democratic People’s Republic of Korea (DPRK). On-chain investigator ZachXBT has linked later laundering flows to operators associated with suspected DPRK actors. Attribution has not been confirmed, and Bitget has not released a final forensic report.

Recovery Remains a Fraction of the Losses

Bitget published the attacker’s addresses and a Recovery Bounty Program paying 5% of funds frozen through voluntary third-party help.

NEAR Intents, a cross-chain swap system on the NEAR blockchain, and SHIELD said attackers tried to route more than $50 million through NEAR Intents after the breach. By September 28, NEAR Intents had frozen $503,000 mid-swap, allowed about $166,000 to complete, and rejected the remainder. The roughly $669,000 that entered that route equals about 0.17% of the disclosed theft. NEAR Intents waived a potential $50,300 bounty. The frozen $503,000 is restricted, not returned.

THORChain, a decentralized protocol for swapping assets across blockchains, declined Chen’s request to block the hacker wallets. Stolen XRP and other assets have continued moving toward Bitcoin through that route.

What Remains Open

Bitget says the vulnerability has been patched, no further unauthorized transfers have been detected, deposits and trading continued throughout the freeze, and customer account balances were not altered. Chen hosted live updates on X on September 28 and 29.

Bitget has said a formal security report is due this week. The third-party security product has not been named publicly, and North Korean involvement remains a working theory rather than a confirmed finding. Merkle Tree verification lets a user confirm that a balance was included in the September 29 snapshot. It does not show whether the protection fund could absorb another incident of similar size.

As USDT withdrawals come due, the record stands as follows: hot and warm wallets were compromised, cold wallets were not, reserves covered all 19 listed assets above 1:1 at the September 29 snapshot, customers withdrew a net $463 million in a day, and the protection fund now holds less than half the amount cited when withdrawals were frozen.

Also Read: Bitcoin Treasury Firm ‘Smarter Web’ Targets £15-25M Raise via MORE Preferred Shares IPO 

Follow The Crypto Times on Google News to Stay Updated!     

Daily Crypto Puzzles

Tickerdle Crypto Connections Crypto Crossword