Bitget Restarts Bitcoin Withdrawals Following $387.5m Wallet Breach
Bitget resumed Bitcoin withdrawals after a third-party security product flaw let attackers steal $387.5M in unauthorized transfers from hot/warm wallets.
Bitget detected unauthorized transfers from hot and warm wallets on September 24, with losses revised from $351.6M to approximately $387.5M after additional Zcash and TRON transactions were classified. A flaw in a third-party security product gave the attacker high-level internal credentials used to issue fraudulent withdrawal commands that bypassed risk controls; cold wallets and user balances were unaffected and private-key compromise was ruled out. Bitcoin withdrawals reopened at 08:00 UTC on September 28, with ETH on September 29, USDT on September 30, and all remaining services by October 2. Mandiant and SlowMist are supporting forensics and fund tracing, some assets have been frozen, and the loss is covered by Bitget's Protection Fund valued over $464M.
- Unauthorized transfers of ~$387.5M hit hot and warm wallets on September 24
- Third-party security product flaw exposed high-level internal credentials bypassing risk controls
- Cold wallets and user balances unaffected; private key compromise ruled out
- Withdrawals resuming in phases: ETH September 29, USDT September 30, rest October 2
- Mandiant and SlowMist investigating; Protection Fund exceeds $464M
Full article461 words · extracted from infosecurity-magazine.com · click to collapse
The cryptocurrency exchange Bitget has restarted Bitcoin withdrawals four days after unauthorized transfers totaling approximately $387.5m were made from part of its hot and warm wallet infrastructure.
Withdrawals on the Bitcoin network reopened at 08:00 UTC on September 28 after additional security checks.
Bitget's September 26 withdrawal update said the vulnerability behind the incident had been identified and remediated, while its investigation with Mandiant and blockchain security firm SlowMist continued.
Bitget Traces Breach to Third-Party Security Product
The incident was detected on September 24, when Bitget's security systems flagged unauthorized transfers from some of its hot wallets. The exchange initially estimated the affected amount at $351.6m before revising the figure to approximately $387.5m after further transaction classification identified additional affected Zcash and TRON transfers.
Bitget said the revision did not represent additional unauthorized transfers after the incident was contained. The exchange added that its cold wallets were unaffected and that user account balances remained intact.
The withdrawal suspension was introduced as a security measure while Bitget examined the withdrawal infrastructure. Trading and deposits continued during the pause.
The exchange said its investigation had identified the attack path and the underlying vulnerability had been fixed.
In a September 28 statement on X, Bitget said a flaw in a third-party security product gave the attacker high-level internal credentials, which were then used to send fraudulent withdrawal commands that bypassed its risk controls.
Bitget said the loss falls within the coverage of its Protection Fund, which its first incident notice valued at more than $464m.
Ether and Tether Withdrawals Next as Recovery Continues
Bitget's September 26 schedule restores the remaining services in three further phases, each opening at 08:00 UTC. Ether (ETH) is next on September 29, on Ethereum and on the BNB Smart Chain, Arbitrum, Base and Optimism networks.
Tether (USDT) follows on September 30 on Ethereum, BNB Smart Chain, Solana and TRON, with all other tokens, fiat withdrawals and peer-to-peer (P2P) services set for October 2.
Read more on cryptocurrency theft: North Korean Attackers Hit 30,000 Devices and Steal $10.7m
Bitget said the incident remains contained and that no further unauthorized transfers are possible. It also said Mandiant and SlowMist continued to support the investigation, including forensic analysis and tracing of affected funds.
The exchange has launched a recovery bounty program and said it was coordinating with law enforcement, blockchain security firms and other industry participants to trace and recover affected assets. It said some affected assets had already been frozen.
Bitget's investigation has not concluded, meaning details about the attacker's identity and the full extent of the compromise remain subject to further findings. The exchange has said private-key compromise was ruled out based on the investigation to date, and that it would review how it assesses and deploys third-party security products.