Bitget cryptocurrency exchange has released a timeline for restoring withdrawals after a security breach led to the unauthorized transfer of between $350 million and $387.5 million from its hot and warm wallets.
The exchange said the incident, detected on September 24, has been contained and the vulnerability responsible for the attack has been fixed.
According to Bitget, user balances remain unaffected and are backed by its User Protection Fund, which holds more than $464 million in publicly verifiable assets.
The breach was identified at 18:31 UTC on September 24 after Bitget’s security systems detected unusual outflows.
Investigators found that attackers gained access to a critical backend component within the exchange’s wallet infrastructure and used spoofed transaction data to trigger legitimate authorization processes.
Bitget stated that private keys were not compromised and that its cold wallet reserves remained secure throughout the incident.
The stolen assets included XRP, Ethereum (ETH), USDT, USDC, and other cryptocurrencies. The estimated losses were later revised higher after additional Zcash and Tron-related transfers were identified.
Bitget withdrawal schedule after hack
As part of its recovery plan, Bitget announced a phased reopening of withdrawals across its supported networks.
Bitcoin withdrawals on the Bitcoin network are scheduled to resume at 08:00 UTC on September 28. Withdrawals on Ethereum and Ethereum-based networks, including BNB Smart Chain, Arbitrum, Base, and Optimism, are expected to reopen at the same time on September 29.
USDT withdrawals across Ethereum, BNB Smart Chain, Solana, and Tron are set to resume on September 30. All remaining token withdrawals, fiat services, and peer-to-peer functions are planned to return on October 2.
The exchange said the staggered rollout reflects the need to validate withdrawal infrastructure across multiple blockchain networks before fully restoring services.
Bitget investigates attack linked to North Korean hackers
Bitget said attack patterns observed during the breach, including IP and behavioral indicators, closely resemble activity previously associated with North Korean hacking groups.
The exchange is working with cybersecurity firms Mandiant and SlowMist, law enforcement agencies, and blockchain ecosystem partners to investigate the incident and recover assets where possible. It has also launched a recovery bounty program.
Trading and deposits remained operational during the withdrawal suspension, which was implemented as a precautionary measure following the attack.
Bitget Chief Executive Officer Gracy Chen is scheduled to host a live community session on September 28, beginning at 07:30 UTC, shortly before Bitcoin withdrawals resume.
The discussion will focus on the breach, the restoration process, and additional security measures being implemented across the platform.
The company maintains that no further unauthorized transfers are possible and that customer funds remain fully protected through its reserve and protection fund mechanisms.
Featured image via Shutterstock
