Bitget Details $387.5M Breach Attack Path, Bitcoin Withdrawals Resume

Bitget Resumes Withdrawals After $387.5 Million Security Breach

Cryptocurrency exchange Bitget has begun restoring withdrawal services following a significant security breach that resulted in the loss of approximately $387.5 million. CEO Gracy Chen provided new details regarding the incident, explaining how attackers gained access to the exchange’s systems.

Withdrawals Restarting in Phases

Bitcoin withdrawals are now operational on both the Bitcoin Mainnet and the BNB Smart Chain. According to a post on X by CEO Gracy Chen, Bitget had processed 9,585 withdrawal orders, totaling 4,098.036 BTC, by 17:00 UTC+8 on Monday. Withdrawals for Ether, USDT, and other digital assets are scheduled to resume in subsequent phases, starting Tuesday.

This resumption of services comes four days after Bitget suspended all withdrawals in the immediate aftermath of the exploit, which was detected on September 24. Bitcoin withdrawals recommenced at 08:00 UTC on Monday, following the completion of enhanced security checks. The exchange anticipates that withdrawals for all other assets will be fully restored by October 2.

Attack Vector Revealed

In a livestream and subsequent social media update, Chen offered the most detailed explanation to date of the breach. She stated that the attackers exploited vulnerabilities within third-party products to acquire internal credentials. These compromised credentials were then used to execute fraudulent withdrawal commands, which, critically, bypassed the exchange’s existing risk control measures.

Chen emphasized that the exchange’s private keys were not compromised and that its cold wallets remained unaffected by the incident.

Remediation and Investigation Efforts

Bitget confirmed that it has isolated the compromised systems and servers. The exchange has also revoked and reissued internal credentials and has restructured access protocols for its most sensitive infrastructure. The third-party vendor whose products were exploited has been notified, and the affected functionality has been disabled pending a resolution to the vulnerability.

Security firms Mandiant and SlowMist are continuing to assist Bitget with the forensic investigation and the tracing of the stolen assets.

Financial Impact and User Protection

Initially, Bitget estimated the loss at $351.6 million after detecting unauthorized transfers on September 24. This figure was later revised to approximately $387.5 million after additional Zcash and TRON transfers were identified. The exchange clarified that this increase reflected a more comprehensive accounting of the stolen funds rather than additional theft.

Bitget has consistently maintained that user balances remain unaffected and that all losses will be covered by its Protection Fund. At the time of the incident’s disclosure, the fund held over $464 million. Chen announced on Monday that Bitget will inject its own capital into the fund to ensure its value is restored to above $300 million within the week. Historically, Bitget has committed to maintaining the Protection Fund above this threshold, with its August report indicating an average monthly value of $382 million.

“Project Stand Together” Initiative

In conjunction with the withdrawal restoration, CEO Gracy Chen also announced “Project Stand Together.” This new initiative aims to provide a trading fee reward pool, along with additional benefits and protections, for eligible retail, VIP, professional, and market-making users.

Chen described the breach as Bitget’s first security incident of this magnitude in its eight-year history. The exchange’s current focus is on recovery, reinforcing its security measures, and disseminating further findings from the ongoing investigation.