Base

TRON

THORChain

Bitget has started restoring withdrawals after attackers transferred approximately $387.5 million from portions of the exchange’s hot and warm wallet infrastructure, while forensic investigators continue tracing the stolen assets and examining the breach.
The attackers exploited a <a href="https://www.bitget.com/campaigns/bitget-security-incident-2026" rel="noopener noreferrer nofollow">vulnerability in a third-party security product</a> to obtain internal access credentials before submitting forged withdrawal commands directly to Bitget’s wallet systems. Those instructions were treated as authorized activity and bypassed existing risk checks. Private keys were not compromised, and Bitget’s cold wallets remained unaffected.
The final affected amount rose from the <a href="https://cryptoadventure.com/bitget-confirms-351-6m-wallet-breach-and-suspends-withdrawals/" rel="noopener noreferrer nofollow">$351.6 million breach</a> initially identified on September 24 to $387.5 million after additional Zcash and TRON transactions were classified.
<h2 id="bitcoin-withdrawals-reopen-after-four-day-pause">Bitcoin Withdrawals Reopen After Four-Day Pause</h2>
BTC withdrawals <a href="https://www.bitget.com/amp/academy/bitget-security-incident-what-happened-timeline-impact-response" rel="noopener noreferrer nofollow">reopened at 08:00 UTC on September 28</a> on Bitcoin and BNB Smart Chain after additional security checks across Bitget’s withdrawal infrastructure.
ETH withdrawals are scheduled for September 29 at 08:00 UTC across Ethereum, BNB Smart Chain, Arbitrum, Base and Optimism. USDT follows on September 30, while remaining tokens, fiat withdrawals and P2P services are scheduled for October 2. Trading and deposits remained available during the withdrawal suspension.
Bitget’s Protection Fund held more than <a href="https://www.bitget.com/campaigns/bitget-security-incident-2026" rel="noopener noreferrer nofollow">$464 million when the incident was assessed</a>, exceeding the currently identified loss. The exchange has designated the fund to absorb the financial impact while leaving user account balances unchanged.
<h2 id="attacker-attribution-remains-unresolved">Attacker Attribution Remains Unresolved</h2>
Bitget has not formally attributed the <a href="https://cryptoadventure.com/community/articles/north-korean-cyber-espionage-in-crypto/" rel="noopener noreferrer nofollow">breach to North Korea</a> or another state-backed group. Mandiant and SlowMist are conducting the independent forensic investigation, and attacker attribution remains outside the exchange’s confirmed findings while that work continues.
The investigation has already moved beyond containment into fund tracing and recovery. Some affected assets <a href="https://x.com/GracyBitget/status/2104602301503816040?s=20" rel="noopener noreferrer nofollow">have been frozen</a> through coordination with exchanges, blockchain projects and security firms, while Bitget is offering a 5% bounty for eligible voluntary actions that directly result in assets being frozen or recovered.
Efforts to restrict the stolen funds have also created a dispute over permissionless cross-chain infrastructure. THORChain rejected Bitget’s request to block identified exploiter addresses, triggering a wider <a href="https://cryptoadventure.com/thorchain-pushes-back-on-bitget-block-request-as-star-xu-questions-decentralization-claim/" rel="noopener noreferrer nofollow">decentralization debate</a> over whether validator-operated protocols should intervene when known stolen assets move through their systems.
Bitget has ruled out <a href="https://cryptoadventure.com/how-wallet-private-keys-and-seed-phrases-get-leaked/" rel="noopener noreferrer nofollow">private-key compromise</a> and isolated the affected systems, while controls around third-party security products, internal access, withdrawal verification and abnormal-activity monitoring are being strengthened.
ETH withdrawals remain scheduled to open at 08:00 UTC on September 29, followed by USDT on September 30 and the remaining withdrawal services on October 2.
The post <a href="https://cryptoadventure.com/bitget-restores-btc-withdrawals-after-387-5m-breach-as-forensics-continue/" rel="noopener noreferrer nofollow">Bitget Restores BTC Withdrawals After $387.5M Breach as Forensics Continue</a> appeared first on <a href="https://cryptoadventure.com" rel="noopener noreferrer nofollow">Crypto Adventure</a>.

Bitget Restores BTC Withdrawals After $387.5M Breach as Forensics Continue

Table of Contents

Crypto Adventure

Other articles published on Sep 29, 2026

Ethereum Just Defied the September Curse But a Major Resistance Wall Still Stands

Bitget Sees 4,098 BTC Withdrawn After Bitcoin Access Reopens

Sei Network has reached 2.63 BILLION transactions in three years...

How Cardano is heading back to school in Los Angeles...

Chainlink Launches CCIP 2.0 for Institutional Cross-Chain Asset Distribution

Crypto Prices on September 29: BTC 1.23%↓, HBAR 22.62%↑

Join our free newsletter for daily crypto updates!