Bitcoin withdrawals have been restored by Bitget after an attack diverted almost $387.5 million (roughly Rs. 3,720 crore) to hacker-owned addresses and led the exchange to halt withdrawals on September 24. According to Bitget, BTC withdrawals were opened at 08:00 UTC on September 28 as planned, marking the start of the gradual resumption of operations following security reviews of its withdrawal system. The firm stated that the vulnerability that led to the problem has been patched and that there have been no other unauthorised transactions since then.
Bitget Identifies Backend Wallet Systems as Attack Target
Accounts of users have not been affected, the company claims. While deposits and trading were ongoing, withdrawals have been put on hold, and Bitget claims that its User Protection Fund will compensate for the losses incurred due to the attack. The attack on Bitget that happened on September 24 started at around 18:31 UTC when unauthorised transactions were noticed in parts of the exchange’s hot and warm wallet architecture. The company believed that the total sum affected by this was around $351.6 million (roughly Rs. 3,374 crore), but it later increased to about $387.5 million (roughly Rs. 3,720 crore).
Bitget has begun the phased resumption of withdrawals following the security incident identified on September 24, with BTC withdrawals on the Bitcoin network started at 08:00 UTC on September 28 as scheduled.
The resumption follows additional security work across Bitget’s…
— Bitget (@bitget) September 28, 2026
As reported by the CEO Gracy Chen on a live stream on September 28, the intruder was able to exploit a flaw in a security tool used by the company and get access to the high-level credentials of the internal network. As reported by the company, the credentials were then misused to create fake withdrawal requests. “The attacker then used these credentials to send fraudulent withdrawal commands to the wallet system,” Bitget said in its account of the breach.
According to the firm, there was no loss of any private keys and that their cold wallets were not affected. Bitget’s incident report outlines the attack that targeted the firm’s backend wallet systems and input fake transaction data into its authorisation system. The investigation is still being assisted by Mandiant and SlowMist, the blockchain security firm. According to Bitget, the company’s own security team found the way the hack took place and fixed the weakness that enabled the hack.
Bitcoin was the first coin that was withdrawn from Bitget’s withdrawal pause. Bitget resumed withdrawals for BTC on the Bitcoin network at 08:00 UTC on September 28, four days after the start of the pause. Next up in the schedule is Ether. ETH withdrawals will resume on September 29 at 08:00 UTC on Ethereum, BNB Smart Chain, Arbitrum, Base, and Optimism chains. USDT withdrawals will resume on September 30 at 08:00 UTC on Ethereum, BNB Smart Chain, Solana, and Tron.
Get your daily dose of tech news, reviews, and insights, in under 80 characters on Gadgets 360 Turbo. Connect with fellow tech lovers on our Forum. Follow us on X, Facebook, WhatsApp, Threads and Google News for instant updates. Catch all the action on our YouTube channel.
