Highlights
- Bitget says the flaw behind its September 24 breach is fixed and withdrawals will reopen in four stages between September 28 and October 2.
- The confirmed loss now stands at $387.5 million, roughly 84% of a User Protection Fund that held more than $464 million.
- Circle and Tether froze about $318,000 in USDC and USDT at an address tagged "Bitget Exploiter 8."
- On-chain data shows a wallet pulling $1.23 million out of Binance and routing it, as 457.9 ETH, to the hacker's address.
Bitcoin comes first. Starting at 08:00 UTC on September 28, Bitget customers will be able to move BTC off the exchange for the first time since a backend breach drained $387.5 million from its hot and warm wallets four days earlier, the company said on Friday, laying out a staggered timetable that runs through October 2.
The exchange said the vulnerability exploited in the September 24 incident has been identified and patched, and that each phase opens only after security checks are complete. Account balances were not touched, according to Bitget, and trading and deposits have stayed live throughout. The pause, it said, exists for security reasons alone and says nothing about whether customer assets are available.
The reopening schedule
Each window opens at 08:00 UTC. BTC on the Bitcoin network goes first on September 28. Ether follows on September 29 across Ethereum, BNB Smart Chain, Arbitrum, Base and Optimism. USDT returns on September 30 on Ethereum, BSC, Solana and TRON. Every other token, along with fiat and peer-to-peer withdrawals, is slated for October 2. Internal and external security teams will keep auditing and verifying the infrastructure while the stages roll out.
Half an hour before the first window, CEO Gracy Chen and Xie Jiayin, who runs the exchange's Greater China business, will host a livestreamed AMA scheduled for at least two hours from 07:30 UTC. The session is meant to cover how the breach unfolded, where withdrawals stand and what comes next.
A bigger bill than first reported
Bitget detected abnormal movements at 18:31 UTC on September 24 and froze withdrawals across the platform. Its first estimate put the damage at $351.6 million, the number the company gave as the scale of the attack first came into view. The number has since climbed by $35.9 million after additional Zcash and TRON transfers were confirmed, taking the total to $387.5 million.
The stolen funds span a wide spread of assets: XRP, ETH, USDT, USDC, USDT0, ZEC, Tether Gold, BNB, AVAX and TRX, pulled across several chains including Ethereum, the XRP Ledger, Zcash and TRON. Bitget says the attacker did not steal private keys. Instead, the intruder got into a backend system and spoofed transaction data, which allowed transfers to go out looking legitimate. The damage stayed in parts of the hot and warm wallet layers, while cold storage was not affected.
Related: Bitget Hack Grows to $351.6M as CEO Points to North Korea
The exchange's User Protection Fund held more than $464 million when the breach hit, and Bitget says the fund will absorb the full financial impact. At $387.5 million, that is about 84% of the reserve, which leaves the backstop thin until it is rebuilt. Bitget's own token, BGB, slipped 3.3% on September 25 as the withdrawal freeze dragged into a second day.
Following the money
Recovery efforts are producing small but real results. Circle and Tether blacklisted an address labelled "Bitget Exploiter 8," locking up 218,023 USDT and 99,990 USDC, or roughly $318,000 combined. Circle acted at 05:00 UTC on September 25, less than 11 hours after the breach was detected. Bitget also says other affected assets have been frozen through coordination with industry partners, without giving totals, and it is offering a 5% bounty on anything successfully frozen or recovered.
The on-chain trail also turned up a stranger movement. According to Lookonchain, a wallet beginning 0x4885 withdrew 257.6 ETH (about $692,000) and 545,000 USDT from Binance, swapped the USDT for 200.2 ETH, and then sent the full 457.9 ETH, worth around $1.23 million, to the Bitget hacker's wallet roughly an hour later. Why funds would flow into an exploiter's address rather than out of it is unclear. It may be consolidation by the same operators. Either way, the withdrawal from a major centralized exchange hands investigators a potential identity lead, since Binance accounts sit behind know-your-customer checks.
Chen has said the attack's patterns match groups previously linked to North Korea, though attribution has not been confirmed. That matters for how the case plays out. Pyongyang-linked crews have been the subject of a joint exposure by Japanese, US and German authorities, and their laundering playbook usually means splitting funds across chains and mixers quickly. That window is narrowing for any stablecoins still sitting in identifiable addresses. Google-owned Mandiant and blockchain security firm SlowMist are assisting the forensic work, and Bitget has not yet published a full root-cause report.
What to watch
The September 28 BTC window is the first real test. A controlled reopening with no sign of a bank-run style outflow would suggest customers accept the protection-fund pledge. A rush for the exits would put pressure on the ETH and USDT phases that follow. Beyond that, traders will want three things: the promised incident report, clarity on how much of the $387.5 million has actually been frozen, and a plan to replenish a protection fund that now covers far less than it did a week ago.
The breach also lands during a rough run for security across the sector. Smaller incidents such as the $2.3 million Meter exploit and a $1.7 million NFT drain have kept piling up, but an attack of this size on a top-tier centralized exchange is a different category of event. How cleanly Bitget handles the next seven days will shape how much trust it keeps.
