Bitget resumes withdrawals in phases after security incident

Bitget resumed BTC withdrawals on the Bitcoin and BSC networks at 08:00 UTC on September 28. The September 24 incident was the first security incident of this nature to affect Bitget Exchange in eight years of operation. The investigation found that an attacker exploited a vulnerability in a third-party security product to obtain high-level internal credentials. The attacker used those credentials to send fraudulent withdrawal commands to the wallet system. The abnormal transfers bypassed risk controls. Private keys were not compromised. Cold wallets were not affected. No further unauthorized transfers have been identified since containment. Bitget confirmed that approximately $388 million in assets were transferred out during the incident. The amount reflects the latest reconciliation and classification of associated transactions. Mandiant and SlowMist continue to support the independent forensic investigation. Their work covers the attack vectors and methods used. It also covers the validation of containment and remediation measures. The investigation includes asset tracing. Bitget is working with law enforcement, exchanges, blockchain projects, on-chain security specialists and other industry partners on tracing and recovery. Some affected assets have been frozen. Bitget has published identified attacker addresses and related tracing data. Bitget expects to complete an official security report this week. The report will disclose detailed findings. Bitget will share further material developments as they are verified. ETH withdrawals across Ethereum, BSC, Arbitrum, Base and Optimism are scheduled to resume on September 29 at 08:00 UTC. USDT withdrawals across Ethereum, BSC, Solana and Tron are scheduled to resume on September 30 at 08:00 UTC. Withdrawals for other supported tokens are set to resume on October 2 at 08:00 UTC. Fiat and P2P services are also set to resume at that time. Bitget says withdrawal availability will be reflected on its platform. As of 09:00 UTC on September 28, 9,585 users had initiated withdrawals since resumption. Those withdrawals totaled approximately 4,098 BTC. Withdrawal status was described as normal. Bitget says it has strengthened its wallet infrastructure and risk controls over the past eight years. The company introduced monthly Proof of Reserves. It also established a User Protection Fund. Bitget reports a comprehensive Proof of Reserves ratio of 127%. Its User Protection Fund stands at more than $464 million. Following the incident, Bitget introduced stricter assessment criteria for third-party products. It strengthened controls over their deployment. It also introduced independent verification for withdrawals. Bitget is strengthening internal access controls. It is also strengthening withdrawal verification. The company is strengthening abnormal activity monitoring across its platform. The Bitget Alliance Program allows eligible users to share in transaction fees generated through platform trading. The program runs from September 28 at 08:00 UTC to October 26 at 08:00 UTC. Project Stand Together offers eligible PRO clients and market makers special fee discounts. The program also offers extended PRO level protection. Preferential rates run from September 28 at 10:00 UTC to October 30 at 09:00 UTC. PRO level protection runs through November 30 at 09:00 UTC.