Bitget resumes Bitcoin withdrawals after $387.5 million crypto heist
Bitget resumed Bitcoin withdrawals after a suspected North Korean theft of $387.5 million.
Cryptocurrency exchange Bitget said suspected North Korean hackers stole $387.5 million, revised up from $351.6 million, from hot and warm wallets. CEO Gracy Chen said the attackers breached wallet backend infrastructure, spoofed transaction data, and triggered transfers across Ethereum, XRP Ledger, Arbitrum, Avalanche, Optimism, BSC, and Base. Bitcoin withdrawals have resumed after the exploited flaw was fixed, with ETH, USDT, and remaining assets scheduled through October 2, and a 5 percent recovery bounty offered.
- Stolen total was revised to $387.5 million after on-chain tracing.
- Bitget blames North Korean hackers using IP and on-chain patterns.
- Attackers spoofed transaction data to drain hot and warm wallets.
- Protection Fund covers losses; other withdrawals resume through October 2.
Full article445 words · extracted from bleepingcomputer.com · click to collapse
Cryptocurrency exchange Bitget has resumed Bitcoin withdrawals suspended after suspected North Korean hackers breached its systems last week and stole over $350 million.
Bitget added that it has addressed the security vulnerability exploited in the incident and will restore withdrawal services for all other supported assets and networks as soon as possible.
It also shared an estimated withdrawal resumption schedule, saying that it will also resume withdrawals for ETH (Ethereum, BSC, Arbitrum, Base, Optimism) on September 29 at 8:00 UTC, for USDT (Ethereum, BSC, Solana, Tron) on September 30 at 8:00 UTC, and for other tokens / Fiat / P2P assets starting October 2 at 8:00 UTC.
"The temporary withdrawal pause remains a security measure and is not related to the availability of user assets. User account balances remain unaffected, and Bitget's Protection Fund covers the financial impact of this platform-wide incident," it noted.
"The incident remains contained, and no further unauthorized transfers are possible. User funds are unaffected throughout this process. Trading and deposits continue to operate."
Bitget suspended all withdrawals on Thursday after its security systems flagged multiple unauthorized transfers from a limited number of crypto wallets and discovered that attackers had stolen $351.6 million from its hot and warm wallets.
Bitget CEO Gracy Chen said the incident involved the Ethereum, XRP Ledger, Arbitrum, Avalanche, Optimism, BSC, and Base chains and affected multiple assets, including ETH, XRP, BNB, AVAX, USDT, USDC, and other tokens.
Chen blamed the incident on North Korean hackers, citing on-chain analysis and IP behavior patterns, adding that they breached a critical backend system within Bitget wallet infrastructure and used it to spoof transaction data, triggering the exchange's authorization process to move funds out of compromised hot/warm wallets.
On Friday, Bitget updated the amount of assets stolen in the attack, saying that $387.5 million was transferred to attacker-controlled addresses, according to the latest on-chain tracing and transaction classification.
The company also launched a Recovery Bounty Program, offering bounties of 5% for helping to recover or freeze all frozen funds.
North Korean state-sponsored threat groups have been linked to many other major crypto theft incidents over the years, including the largest crypto heist ever recorded, in which they stole $1.5 billion from Bybit's ETH cold wallet.
British blockchain analytics firm Elliptic estimated in February 2025 that North Korean hackers have "stolen over $6 billion in crypto assets since 2017."
Build your security blueprint for AI-powered attacks
Join Mikko Hyppönen and security leaders from the NFL, CHANEL, and Atlassian for a two-hour digital summit on what AI-speed attacks change, what defenders should stop doing, and how to validate, decide, fix, and re-validate at machine speed.