Bitget plans to begin restoring withdrawals on September 28 after investigators determined that its September 24 security breach affected approximately $387.5 million in digital assets.
The revised total is higher than the exchange’s initial $351.6 million estimate because subsequent tracing added Zcash and Tron assets that were not fully counted earlier. Bitget says the increase represents improved accounting rather than additional theft, according to the exchange’s incident update and The Block’s continuing coverage. Bitget Support Center
The Withdrawal Schedule
Bitcoin withdrawals are scheduled to reopen first on September 28. Ether withdrawals across Ethereum, BNB Smart Chain, Arbitrum, Base and Optimism are planned for September 29.
USDT withdrawals on Ethereum, BNB Smart Chain, Solana and Tron are scheduled for September 30. Other tokens, fiat services and peer-to-peer transactions are expected to return on October 2, according to the published staged schedule and Bitget’s official withdrawal update. TokenPost
Deposits and trading have remained available. The delayed restoration is intended to give Bitget time to validate individual networks and wallet systems rather than reopening every withdrawal route simultaneously.
Backend Controls, Not Private Keys
CEO Gracy Chen said the attacker compromised a critical backend component within Bitget’s wallet infrastructure. The intruder allegedly spoofed transaction information and triggered the platform’s normal authorization process.
Bitget says private keys and cold wallets were not compromised. Its separate self-custodial Bitget Wallet product was also unaffected because it operates on different infrastructure.
The exchange reports that the underlying vulnerability has been identified and remediated. Mandiant and SlowMist are assisting with investigation, validation and asset tracing. A detailed technical postmortem explaining how the authorization controls were bypassed has not yet been published.
Recovery Efforts Capture Only a Small Fraction
Circle and Tether froze approximately $318,000 in USDC and USDT held by one address linked to the attacker. Other identified addresses retained more than 63,000 ETH, which has no centralized issuer capable of freezing it, according to CoinDesk’s review of the onchain activity. coindesk.com
Bitget has also opened a recovery bounty program covering voluntary actions that lead directly to stolen assets being frozen or returned. The exchange says some cooperation has already occurred but has not published a verified total for assets recovered.
The company’s protection fund was valued above $464 million when the breach was disclosed. Bitget says the fund covers the loss and that customer balances remain intact. The reserve’s composition, valuation after compensation and replenishment plan will determine how much financial protection remains after the incident.
TOKEN RECON ASSESSMENT
The staged withdrawal plan moves Bitget from emergency containment into a measurable recovery process.
The first confirmation point is simple: Bitcoin withdrawals must reopen on September 28 and process normally. Each subsequent stage will test whether Bitget can safely reconnect additional networks without delays, manual reviews or new irregularities.
The revised $387.5 million estimate also places greater pressure on the protection fund. Nominal coverage is not the same as immediately available liquidity, especially if part of the fund consists of volatile assets.
Token Recon is watching:
- Successful reopening of Bitcoin withdrawals
- Processing times and withdrawal limits
- The complete technical postmortem
- Verified amounts frozen or recovered
- Protection-fund composition and replenishment
- Evidence supporting or rejecting reported North Korean attribution
- Changes to backend authorization and transaction-verification controls
- Phishing campaigns impersonating Bitget support
The exploit demonstrated that secure private keys cannot compensate for a backend system that authorizes falsified transaction data. Bitget’s next battle is proving that the redesigned control path can be trusted under real withdrawal demand.
Sources
Bitget: Fund tracing and recovery bounty update
Bitget: Original September 24 security notice
Bitget: Staged withdrawal update
The Block: Bitget raises breach estimate to $387.5 million
CoinDesk: Circle and Tether freeze stablecoins linked to the attacker
