Bitget Reopens Bitcoin Withdrawals After $388M Hack, 3,326 BTC Out

Bitget has reopened Bitcoin withdrawals, four days after suspending them over a security incident, and the platform recorded 3,326 BTC leaving within the first hour, according to Cryptobriefing, citing CryptoQuant data. The reopening began with Bitcoin, with other assets to follow later in the week.

Cointribune reports the same restart in more detail, attributing it to a hack that cost the exchange nearly $388 million. That outlet says Bitcoin withdrawals resumed on September 28 at 8 AM UTC on Bitcoin and BSC, with Ethereum scheduled for September 29. The two accounts agree on the sequence but differ on scale: Cryptobriefing describes a 3,326 BTC first-hour outflow, while Cointribune reports that Bitget had already processed 9,585 withdrawals representing about 4,098 BTC by 9 AM UTC.

Key facts

• 3,326 BTC left Bitget in the first hour after Bitcoin withdrawals reopened, per CryptoQuant data cited by Cryptobriefing.
• Cointribune reports Bitget processed 9,585 withdrawals representing about 4,098 BTC by 9 AM UTC on the day of the restart, with Bitcoin returning on September 28.
• The attack on September 24 began at 6:31 PM UTC with two small test transactions, 0.184 ETH and 193 TRX, both below Bitget’s risk-control thresholds, according to Cointribune.
• Seventeen transactions followed across eight networks, moving about $361 million to attacker-controlled addresses, with the total loss later revised to roughly $388 million.
• Bitget’s User Protection Fund exceeded $464 million at the time of the attack, Cointribune reports.

A third-party flaw, not a broken key

Cointribune reports that Bitget’s private keys were not compromised and no cold wallet was emptied. In a statement dated September 28, 2026, the exchange said the attacker exploited a vulnerability in a third-party security product to obtain high-level internal credentials, then used that access to inject withdrawal orders the system treated as legitimate. Cointribune also notes that the same internal access let the attacker delete some traces of their commands, which complicated reconstruction of the events.

The timeline was tight. After the two small transactions at 6:31 PM UTC on September 24, the attacker waited about thirty minutes. Seventeen transactions then ran between 6:58 PM and 8:09 PM UTC across Ethereum, XRP Ledger, Zcash, BNB Chain, Base, Arbitrum, Optimism and Avalanche. Bitget began blocking withdrawals seven minutes after the first large transfer, according to Cointribune. The original estimate of $351.6 million was later raised to about $388 million after analysis of movements on Zcash and Tron.

Mandiant and SlowMist are involved in the investigation, and Bitget says it has identified the vulnerability, fixed it and tightened controls. Cointribune reports that a North Korean link is being examined but remains a hypothesis until a full report is published.

The recovery fight moves on-chain

Some of the stolen funds passed through THORChain before being converted to Bitcoin. Cointribune reports that THORChain declined to block addresses tied to the theft despite a public request from Bitget, with CEO Gracy Chen making the appeal directly on X. Cointribune also reports that Bitget had delisted RUNE, THORChain’s token, a few days before the incident. Users replying to Chen pointed out that the protocol is not built to freeze accounts on demand.

Bitget has opened a recovery programme offering 5% of frozen funds and 5% of recovered sums as bounties to parties whose intervention directly enables recovery, per Cointribune. The exchange also plans to publish a security report this week.

Why it matters

The breach shifts attention from key management to internal access and third-party software, a perimeter exchanges do not fully control. Cointribune frames the case as part of a heavy year for crypto security, noting that Ethereum accounted for 53% of losses recorded in 2026. The size of Bitget’s Protection Fund relative to the loss is what kept customer balances insulated, but a fund absorbs a shock rather than preventing the next one. The dispute with THORChain also exposes a practical limit on recovery: publicly visible transactions do not translate into a way to stop them.

What to watch

Bitget’s security report, promised this week, should detail how the third-party access was obtained and what controls changed. The phased return of Ethereum and other assets, plus further on-chain movement of the stolen funds and any regulatory response, are the next checkpoints.

Nothing here is financial advice, and crypto markets are volatile and uncertain.

Disclaimer: This article is for information only and is not investment, financial or trading advice. Cryptocurrency prices are highly volatile. Always do your own research.

Sources: Crypto Briefing, Cointribune