TheBlock
Bitget began restoring withdrawals in stages after an exploit drained about $388 million from the exchange on Sept. 24. BTC withdrawals on the Bitcoin network resumed at 8 a.m. UTC on Monday, following security checks. ETH withdrawals across Ethereum, BSC, Arbitrum, Base and Optimism are scheduled to reopen Sept. 29, followed by USDT withdrawals across Ethereum, BSC, Solana and Tron the next day.
Why it matters
The incident is the largest reported crypto theft so far this year, exceeding the reported exploits at KelpDAO and Drift Protocol. Bitget said the attacker exploited a vulnerability in a third-party security product to obtain high-level internal credentials, then used them to send fraudulent withdrawal commands that bypassed risk controls.
Bitget said its private keys were not compromised and user balances and cold wallets were unaffected. The exchange says it patched the vulnerability, contained the incident and has seen no further unauthorized transfers. Mandiant and SlowMist are assisting with the investigation, and Bitget said it will review how it evaluates and deploys third-party security products.
Market impact
The staged schedule leaves remaining assets, fiat withdrawals and peer-to-peer transactions set to resume Oct. 2. Bitget says losses will be fully covered by its User Protection Fund, which holds 5,500 BTC. It has also offered a bounty of 5% of funds successfully frozen or recovered to parties whose actions directly lead to their recovery.
The exchange has not reached a firm conclusion on the attackers’ identity. It described them as sophisticated and state-backed, and previously said it suspected North Korea. The investigation and completion of the withdrawal schedule are the next key tests for confidence in the exchange’s recovery.
Frequently asked questions
-
How is Bitget reopening withdrawals after the exploit?
Bitget is restoring withdrawals in stages after security checks on each chain. BTC withdrawals resumed first, with ETH and USDT withdrawals scheduled next.
-
When are Bitget's ETH and USDT withdrawals scheduled to resume?
ETH withdrawals across Ethereum, BSC, Arbitrum, Base and Optimism are scheduled for Sept. 29 at 8 a.m. UTC. USDT withdrawals across Ethereum, BSC, Solana and Tron are scheduled for the following day at the same time.
-
What did the Bitget attacker exploit?
Bitget said the attacker exploited a vulnerability in a third-party security product to obtain high-level internal credentials and issue fraudulent withdrawal commands that bypassed risk controls.
-
What did Bitget say was unaffected by the exploit?
Bitget said its private keys, user balances and cold wallets were not affected. It also said it patched the vulnerability and that no further unauthorized transfers had occurred.
-
How does Bitget plan to cover the reported $388 million loss?
Bitget said losses will be fully covered by its User Protection Fund, which holds 5,500 BTC. It also launched a bounty offering 5% of funds successfully frozen or recovered.
WatcherGuru
CoinTelegraph
Lookonchain
WuBlockchain
Crypto News
CoinDesk