Cryptocurrency exchange Bitget has officially initiated a phased restoration of platform withdrawal services following a major security breach that resulted in the theft of $387.5 million in digital assets. The operational reopening represents the platform’s first major step toward normal operations since detecting unauthorized capital outflows on September 24. Bitget reaffirmed that its $464 million User Protection Fund will fully absorb the financial impact, keeping user account balances completely whole.
Bitget has begun the phased resumption of withdrawals following the security incident identified on September 24, with BTC withdrawals on the Bitcoin network started at 08:00 UTC on September 28 as scheduled.
The resumption follows additional security work across Bitget's…
— Bitget (@bitget) September 28, 2026
Bitget Begins Phased Withdrawal Schedule Following Infrastructure Remediation
To ensure system stability, Bitget is executing a structured, asset-by-asset schedule to bring wallet services back online. The restoration process began on September 28 at 08:00 UTC with the reopening of Bitcoin (BTC) network withdrawals. Ethereum (ETH) withdrawals are scheduled to resume on September 29, followed by Tether (USDT) on September 30. The exchange expects all remaining digital assets, fiat gateways, and peer-to-peer (P2P) trading features to return to standard operations by October 2.
Bitget clarified that the phased timeline applies uniformly to all platform users without preferential queueing. Exchange leadership emphasized that trading execution and deposit services remained fully operational throughout the withdrawal pause, framing the temporary freeze as a deliberate containment protocol rather than a liquidity constraint.
On-Chain Forensic Analysis Expands Total Exploit Figure to $387.5 Million
Following initial disclosures estimating losses at $351.6 million, Bitget updated its total loss assessment to $387.5 million based on revised on-chain transaction tracing. The exchange clarified that the higher figure reflects a comprehensive accounting of the original September 24 exploit rather than a secondary breach.
The compromised assets spanned multiple blockchain environments, including Ethereum, select Ethereum Virtual Machine (EVM) chains, XRP Ledger, Zcash, and Tron. Specific tokens targeted in the exploit included XRP, ETH, USDT, USDC, USDT0, XAUt, BNB, AVAX, TRX, and ZEC.
Bitget confirmed that the underlying system vulnerability has been isolated and patched, preventing further unauthorized transfers. Cyber forensics firms Mandiant and SlowMist are conducting the ongoing investigation and asset-tracking operations. While on-chain analysts detected the movement of approximately $83 million in stolen XRP across attacker-controlled wallets, noting that native XRP cannot be frozen at the base protocol level, Bitget reiterated that its self-funded Protection Fund remains more than sufficient to cover the unrecovered balance.
Preliminary investigative findings continue to explore potential links between the exploit vector and state-sponsored cyber units, specifically North Korean hacking organizations previously associated with large-scale exchange compromises. Bitget continues to work alongside law enforcement and security partners as forensic tracing continues.
Disclaimer: CoinScreamer is an independent media brand owned and operated by NuvexMedia LLC, publishing news, research, and market insights on digital assets and related technologies. NuvexMedia LLC invests in and collaborates with companies across the digital asset, blockchain, and technology sectors. These relationships do not influence CoinScreamer’s editorial coverage, and the publication maintains full editorial independence to provide accurate, timely, and objective information. © 2025 NuvexMedia LLC. All rights reserved. This content is for informational purposes only and should not be considered legal, tax, investment, financial, or other professional advice.
