Bitget starts phased withdrawal resumption following $388 million exploit

Bitget has begun a phased resumption of exchange withdrawals after an exploit drained around $388 million from the platform on Sept. 24.

The crypto exchange said in a statement shared with The Block that it has started processing BTC withdrawals on the Bitcoin network at 8 a.m. UTC on Monday as scheduled. 

Before resuming withdrawals, Bitget said each chain must pass a series of security checks, which is why withdrawals are being restored in stages. Following today's resumption of BTC withdrawals, ETH withdrawals on Ethereum, BSC, Arbitrum, Base, and Optimism will be opened on Sept. 29 at 8 a.m. UTC, it said. 

USDT withdrawals on Ethereum, BSC, Solana, and Tron will resume at the same time the following day, while all remaining assets, fiat withdrawals, and P2P transactions will be restored on Oct. 2, according to the exchange.

The exploit

At around 6:31 p.m. UTC on Sept. 24, unauthorized transfers involving certain assets took place across multiple networks from Bitget's hot and warm wallet infrastructure. The exchange said the attacker targeted a vulnerability in a third-party security product used by Bitget to obtain high-level internal credentials.

"The attacker then used these credentials to send fraudulent withdrawal commands to the wallet system, causing it to execute abnormal transfers that bypassed risk controls," the exchange said.

While Bitget did not specify the stolen crypto assets in its latest statement, The Block previously reported that ether, USDT, USDC, AVAX, and BNB were among the assets transferred.

The exchange explained that its private keys were not compromised, and its user balances and cold wallets were not affected. It said it will review how it assesses and deploys third-party security products to strengthen its controls, with Mandiant and SlowMist assisting with further investigation into the incident.

Bitget said it has patched the vulnerability and contained the incident. It added that there have been no further unauthorized transfers, while confirming the $388 million amount of stolen assets.

The $388 million loss from the exploit makes it the largest reported crypto theft so far this year, above exploits on KelpDAO and Drift Protocol. However, Bitget said losses from the incident will be fully covered by the Bitget User Protection Fund, which holds 5,500 BTC.

In an effort to recover stolen assets, Bitget has launched a bounty program, where parties whose actions directly result in attacker funds being frozen or recovered will receive 5% of the amount successfully frozen.

While Bitget noted that it will not speculate about the attackers' identity until the investigation reaches a firm conclusion, it stated that they were "sophisticated" and "state-backed" and know how to obscure stolen funds. It previously told the media that it suspects North Korea to be behind the attack.