Bitget explains $388 million breach and restarts Bitcoin withdrawals

What happened

On Sept. 24 Bitget experienced a targeted security incident. According to CEO Gracy Chen, the attacker exploited a vulnerability in a third‑party security product to gain high‑level internal credentials. Using those credentials, the attacker issued fraudulent withdrawal commands to Bitget's wallet backend. Those commands triggered abnormal transfers that bypassed the exchange's existing risk controls.

Bitget says private keys and cold wallets were not affected.

Timeline of the breach

• Around 18:31 UTC the attacker began with two small transfers that fell below the exchange's alert thresholds (0.84 ETH and 93 TRX).
• Between 18:58 and 20:09 UTC the attacker executed 17 larger transfers across multiple chains—Ethereum, XRP, Zcash, BNB Smart Chain, Base, Arbitrum, Optimism and Avalanche—worth about $361 million in aggregate.
• Bitget monitoring systems detected a significant discrepancy at 19:05 UTC. The exchange automatically blocked user withdrawals shortly after detection.
• Bitget activated a P0 emergency response at 19:14 UTC and started containment measures. At about 20:40 UTC the wallet team began moving funds to cold storage as a precaution.
• The attacker initiated a second wave of seven transfers between 20:55 and 21:23 UTC across Avalanche, XRP, Ethereum, Zcash, Algorand, TIA and Cosmos, estimated at roughly $30 million.
• By about 21:44 UTC Bitget shut down wallet withdrawal services and isolated withdrawal-related network access.

Bitget's reconciliation and classification of on‑chain activity led to its updated total: approximately $388 million moved during the incident.

Response and containment

Bitget says it identified the attack path within hours and remediated the vulnerability. The exchange reported the incident to law enforcement in the jurisdiction where the relevant entity is based and activated external forensic support.

Forensic firms Mandiant and SlowMist are analyzing attack vectors, validating containment and remediation steps, and tracing on‑chain flows. Bitget is also working with other exchanges, blockchain projects and on‑chain security specialists. The company has published attacker addresses and tracing data to support coordinated recovery efforts, and reports that some assets have already been frozen through those efforts.

Service restoration plan

Bitget began a staged restart of withdrawals after completing security checks across withdrawal infrastructure. Bitcoin withdrawals were scheduled to resume first (reported as resumed on Sept. 28), with other assets phased back according to the exchange's schedule and internal verification.

What Bitget says about internal risk and motive

Chen described the operation as sophisticated: the attacker used legitimate credentials, disguised activity as routine administrative operations and deleted traces. Bitget does not currently believe the incident was an inside job but is withholding attribution until the investigation reaches a confirmed conclusion.

Next steps and transparency

Bitget expects to complete and publish an official security report within days. The exchange says it will disclose additional findings as they are verified and continue cooperative efforts to trace and recover affected assets.