Bitget is scheduled to begin restoring withdrawals today, four days after attackers removed about $351.6 million from parts of the exchange’s hot and warm wallet infrastructure.
Bitcoin withdrawals are due to reopen first at 08:00 UTC on September 28. Ether follows on September 29, USDT on September 30, and the remaining tokens, fiat services and peer-to-peer transfers on October 2. Trading and deposits have continued during the pause.
That timetable makes this more than another exchange-hack story. Bitget says the stolen amount is covered by its User Protection Fund and that cold wallets were not affected. The harder question is whether the exchange has fixed the system that approved the withdrawals in the first place.
The Attack Was Not Described as a Simple Private-Key Theft
Bitget says the incident began at approximately 18:31 UTC on September 24, when its systems detected unauthorized transfers from a portion of its hot and warm wallets across multiple chains.
Its later incident summary said the attacker compromised a critical backend system, spoofed transaction data and triggered Bitget’s own authorization process. That is materially different from one stolen private key. It points to the layer that decides whether a withdrawal request should be trusted before a signing system acts on it.
That distinction matters because exchanges often market cold-storage ratios and multisignature controls as their main custody defenses. Those controls can still fail if a compromised backend can feed an apparently valid instruction into the signing path. Security is not only about protecting keys. It is about protecting every system allowed to tell those keys what to sign.
The Protection Fund Solves the Balance-Sheet Problem, Not the Engineering Problem
Bitget said its User Protection Fund held more than $464 million when the breach was disclosed, enough to cover the estimated $351.6 million loss. For customers, that is an important difference from an exchange that needs to socialize losses or wait for asset recovery before making balances whole.
But a protection fund is financial redundancy. It does not prove that the custody system is safe. In a large exploit, the useful question is whether the fund is being used because an isolated control failed or because the platform discovered a repeatable path into its withdrawal infrastructure.
Bitget says the vulnerability has been identified and remediated, and that Mandiant and SlowMist are supporting the investigation. The staged withdrawal schedule is therefore a live test of that remediation, not merely a return to normal service.
Why Bitcoin Comes Back Before Everything Else
The exchange is restoring withdrawals by asset and network rather than switching the whole platform back on at once. BTC on the Bitcoin network comes first, followed by ETH across Ethereum, BNB Smart Chain, Arbitrum, Base and Optimism, then USDT across four networks.
That sequence reduces the number of moving parts being reactivated at any one time. A centralized exchange that supports hundreds of assets is not operating one withdrawal system. It is operating many chain-specific integrations, signing policies, hot-wallet limits, address controls and risk rules behind one interface.
The staged rollout is therefore more informative than a simple status page saying withdrawals are open. Each additional network increases the surface area the remediated system has to handle.
The Incident Also Changes How Bitget’s Other Products Should Be Read
Optimisus has previously covered Bitget as a venue expanding beyond conventional spot crypto, including research on liquidity in Bitget’s tokenized equity and gold perpetual markets. Those products depend on the same broader trust relationship as ordinary exchange balances: users are relying on the platform’s custody, risk controls and operational continuity.
The lesson is not that centralized venues cannot be secure. It is that product breadth increases operational complexity faster than a simple reserve figure can explain. A platform can have sufficient assets to reimburse users and still need to prove that its authorization architecture deserves to be trusted again.
What to Watch From Here
The first signal is whether the September 28 BTC reopening happens on schedule without another pause. The second is whether Bitget publishes the promised root-cause detail with enough technical specificity for outside security teams to understand what actually failed.
The third is asset recovery. Bitget has launched a recovery bounty program and is tracing stolen funds, but reimbursement from the Protection Fund means customers do not need recovery to occur before the platform can account for the loss.
That is good for users and harder for governance. Once the immediate balance-sheet problem is solved, there is no excuse for treating the root cause as secondary. In this incident, the backend appears to have been the perimeter. The quality of the fix matters more than the size of the fund sitting behind it.
This is not financial advice.
Sources
- Bitget – Security Notice: September 24 Hot Wallet Incident – Primary disclosure of the affected amount, wallet layers and Protection Fund coverage.
- Bitget – Withdrawal Resumption Schedule – Primary timetable for restoring BTC, ETH, USDT and remaining withdrawals.
- Bitget – Security Incident Timeline and Response – Bitget’s description of the compromised backend and spoofed transaction data.
- Reuters – Bitget pauses withdrawals after $350 million stolen in hack – Independent reporting on the breach and withdrawal suspension.
