Bitget began processing Bitcoin withdrawals at 08:00 UTC Monday, moving the exchange from scheduled recovery into its first live operational test since the September 24 breach.
Sunday’s Evening Token Recon scan reported that withdrawals were scheduled to restart. The material update is that Bitcoin withdrawals are now being processed, according to The Block’s September 28 report and Bitget’s official restoration schedule. The Block
New Detail on the Attack Path
Bitget now says the attacker exploited a vulnerability in a third-party security product to obtain high-level internal credentials. Those credentials were allegedly used to send fraudulent withdrawal commands that bypassed the exchange’s risk controls.
That explanation is more specific than the original description of a backend compromise. Bitget maintains that its private keys and cold wallets were not compromised, but the revised account indicates the attacker reached an authorization layer capable of commanding the wallet system.
Mandiant and SlowMist are assisting with the investigation. Bitget says the vulnerability has been patched, no additional unauthorized transfers have occurred and the approximately $388 million loss will be covered by a protection fund holding 5,500 BTC. Those statements remain the exchange’s account until supported by an independent technical report. The Block
Restoration Remains Deliberately Limited
Only native Bitcoin withdrawals are included in the first phase. Ether withdrawals across Ethereum, BNB Smart Chain, Arbitrum, Base and Optimism are scheduled for September 29 at 08:00 UTC.
USDT withdrawals across Ethereum, BNB Smart Chain, Solana and Tron are scheduled for September 30. Bitget expects other tokens, fiat withdrawals and peer-to-peer transactions to return on October 2.
The exchange says each network must pass additional security checks before withdrawals are enabled. This limits the possibility that a defect affecting one chain or wallet environment immediately exposes the entire platform.
The Attacker Still Controls Substantial Assets
The operational recovery is occurring while the laundering operation remains active. Sunday’s Evening scan documented approximately 1,889.58 BTC, valued near $160.1 million at the time, in addresses Bitget attributes to the attacker.
Nearly all stolen XRP had left the original holding wallets, 2,620 ETH had moved, and about 19.23 BTC had entered CoinJoin transactions. The movement into Bitcoin reduces the effectiveness of issuer-level freezing available for centralized stablecoins.
Bitget has offered a bounty equal to 5% of assets successfully frozen or recovered. The exchange has also described the attacker as sophisticated and state-backed and previously said it suspected North Korean involvement. No public evidence reviewed for this scan establishes the attacker’s identity.
TOKEN RECON ASSESSMENT
The decisive recovery metric is no longer Bitget’s announced timetable. It is whether users can complete withdrawals at scale without delays, reconciliation problems or new unauthorized activity.
The newly disclosed third-party security-product vector widens the security question beyond Bitget’s own code. A credible postmortem must identify the compromised product, explain how high-level credentials bypassed transaction controls and show what independent investigators confirmed. Successful Bitcoin processing is the first recovery checkpoint, not proof that the wider wallet system is secure.
