Bitget Maps Out Withdrawal Timeline After $350 Million Hack

When Bitget detected an unauthorized outflow of more than $350 million on September 24, the exchange shut down withdrawals and announced a multi‑day recovery plan that juxtaposes a massive security failure with a carefully staged reopening of its services.

The breach, traced to a compromised backend component in Bitget’s hot‑wallet infrastructure, allowed attackers to spoof transaction data and move assets—including XRP, ETH, USDT, USDC, Zcash and Tron—without ever exposing private keys or cold‑wallet reserves. Bitget’s security team flagged the anomaly at 18:31 UTC, contained the vulnerability, and confirmed that user balances remain protected by a publicly audited User Protection Fund holding over $464 million.

Why the timeline matters extends beyond Bitget’s own user base. Institutional investors who allocate capital to crypto exchanges watch how quickly platforms can remediate large‑scale incidents. The staggered withdrawal schedule—Bitcoin resuming at 08:00 UTC on September 28, Ethereum‑based networks on September 29, USDT on September 30, and all remaining tokens plus fiat services on October 2—signals a risk‑managed approach that could influence market sentiment and liquidity across major blockchain ecosystems.

From a structural standpoint, the phased rollout reflects a layered validation process. Each network undergoes independent health checks, transaction‑replay testing, and audit of signature verification before the next tier is unlocked. This methodology mirrors best practices in traditional finance, where settlement systems are often re‑enabled incrementally after a breach to prevent cascading failures.

Bitget has enlisted Mandiant and SlowMist, alongside law‑enforcement partners, to investigate links to North‑Korean hacking groups—an attribution that adds geopolitical weight to the incident. The exchange also launched a recovery bounty, offering incentives for community members who can trace the stolen funds on‑chain.

Market reaction has been mixed. Bitcoin’s price showed a modest dip of 1.2 % on the day withdrawals were halted, while Ethereum slipped 1.5 %. However, the announcement of a concrete restoration plan helped stabilize trading volumes, and analysts note that the clear communication may mitigate longer‑term reputational damage. Institutional traders, many of whom rely on Bitget for liquidity provision, are likely to reassess exposure to exchanges that keep sizable hot‑wallet balances, potentially shifting capital toward custodial services with stronger cold‑storage guarantees.

Real‑world implications are immediate for everyday users. Traders awaiting Bitcoin or USDT withdrawals will experience a brief delay, but the schedule provides certainty that funds will be released in a predictable order. For the broader ecosystem, the incident underscores the growing importance of multi‑signature controls, real‑time anomaly detection, and transparent fund‑protection mechanisms.

CEO Gracy Chen will host a live community session on September 28 at 07:30 UTC, just before Bitcoin withdrawals restart. In the briefing, she is expected to detail the technical fixes, outline enhancements to the wallet architecture, and answer questions about the bounty program. Such direct engagement is a strategic move to rebuild trust and demonstrate accountability.

Overall, Bitget’s response offers a case study in how crypto platforms can balance rapid remediation with methodical risk assessment. The episode may accelerate industry‑wide adoption of tighter withdrawal controls, influence regulatory expectations, and shape how institutional capital flows through the volatile world of digital assets.