Bitget restores withdrawals after US$387.5 million crypto theft; recovery continues
Attackers stole US$387.5 million from Bitget’s exchange wallets, later reported as about US$388 million. Withdrawals fully resumed on 2 October. Bitget says customer balances were unaffected. Use official channels and beware recovery scams.
Nothing for you to patch: Bitget says it repaired its systems and restored withdrawals. Check service information through Bitget’s official app or website, and be wary of impersonators and unofficial recovery services.
What’s happening
Attackers stole cryptocurrency from Bitget’s custodial exchange wallets on 24 September, prompting a withdrawal suspension while deposits and trading continued. Bitget revised the loss to US$387.5 million the next day; its later account gives approximately US$388 million. The company says attackers exploited a flaw in a third-party security product to obtain internal credentials and authorise fraudulent transfers. Its investigation ruled out stolen private keys. Bitget says cold wallets and its separate self-custodial Bitget Wallet product were unaffected. It reported fixing the vulnerability and said customer balances were unchanged, with the financial impact covered by its Protection Fund. Withdrawals reopened in stages and were fully restored on 2 October. As of its 20 October update, the incident remained contained and asset recovery continued. Some stolen assets had been frozen, but Bitget had not published a cumulative frozen or recovered total.
- What
- Breach
- Affects
- Bitget cryptocurrency exchange
- Fixed in
- Nothing to patch
- Since
- 24 Sept 2026
- Closed
- 20 Oct 2026
Timeline
- Vendor revised
Bitget’s updated account put the final affected amount at approximately US$388 million and reported no further unauthorised transfers after containment. Recovery continued; some assets were frozen, but a cumulative frozen or recovered total had not been published.
- Update
Bitget confirmed completion of withdrawal restoration, including remaining tokens, fiat and customer-to-customer services.
- Update
Bitget said its Protection Fund had been replenished to more than US$300 million.
- Update
Bitget announced that Mandiant and SlowMist investigation reports were available, both identifying compromised third-party security products as enabling access to the exchange’s wallet environment.
- Update
Bitcoin withdrawals began reopening. Bitget said attackers had exploited a third-party security product to obtain internal credentials; private keys had not been compromised.
- Update
Bitget announced staged withdrawal restoration from 28 September to 2 October. It said customer balances were unaffected and its Protection Fund covered the financial impact.
- Vendor revised
Bitget raised the stolen total from US$351.6 million to US$387.5 million after including Zcash and Tron transfers from the original incident. It said the vulnerability had been remediated, some assets had been frozen and a 5% recovery bounty programme had begun.
- Made publicNothing to patch
Bitget’s updated timeline places the first unauthorised transfers at 18:31 UTC and detection at 19:05 UTC, when its systems blocked withdrawals. The theft affected part of its hot and warm wallet infrastructure.
Sources
- Bitget Security Latest Incident Update: Fund Tracing and Recovery Bounty ProgramBitget · 25 Sept 2026
- Bitget to Resume Withdrawals in PhasesBitget · 26 Sept 2026
- Update On Slowmist and Mandiant ReportBitget · 30 Sept 2026
- Bitget announcement on completing the phased resumption of token withdrawals, fiat, and C2C servicesBitget · 2 Oct 2026
- Bitget Hack Explained: Timeline, Impact and Security ResponseBitget · 20 Oct 2026
- Bitget confirms $387.5 million security breach affecting exchange hot walletsThe Block · 24 Sept 2026
- Bitget starts phased withdrawal resumption following $388 million exploitThe Block · 28 Sept 2026
- Crypto exchange Bitget says $352 million affected in a hack, claims user funds are 'safe'CoinDesk · 24 Sept 2026