Bitget Reopens Withdrawals After $388 Million Crypto Hack

Bitget has begun restoring withdrawals for its users after an exploit drained approximately $388 million from the exchange's hot and warm wallets. The unauthorized transfers started on September 24, around 6:31 p.m. UTC, after an attacker exploited a flaw in a third-party security product to obtain high-level internal credentials.

The attacker then used these credentials to send fraudulent withdrawal commands to the wallet system, causing it to execute abnormal transfers that bypassed risk controls. Bitget has assured its users that its private keys, cold wallets, and user balances were not compromised during the attack.

The exchange is rolling out withdrawals in a staggered manner, with Bitcoin (BTC) withdrawals opening on September 28, followed by Ethereum (ETH), USDT, and other tokens. The restoration of full services is expected to be completed by October 2. Bitget has also launched a bounty offering 5% of any attacker funds frozen or recovered.