Bitget Resumes Withdrawals After Security Breach, Losses Covered by Protection Fund
Cryptocurrency exchange Bitget announced that the vulnerability exploited in a recent security breach has been patched, and withdrawal services will be gradually reinstated in four phases. Bitcoin withdrawals were the first to resume, at 4:00 PM Taiwan time on September 28. Ethereum and USDT withdrawals followed on September 29 and 30, respectively, with other tokens, fiat currencies, and P2P services scheduled to be restored on October 2. Bitget stated that user balances remain unaffected, and the estimated $387.5 million in losses will be covered by its protection fund.
Phased Withdrawal Restoration Underway
Bitget announced early on September 26, Taiwan time, that the vulnerability involved in the security incident had been identified and fixed. The temporarily suspended withdrawal services will be restored in four stages. Bitcoin withdrawals were the first to be reactivated, commencing at 4:00 PM Taiwan time on Monday, September 28. The final phase, encompassing other tokens, fiat currencies, and P2P services, is slated for Friday, October 2, at the same time.
The exchange clarified in its announcement that the suspension of withdrawals was a precautionary measure to complete a final round of security verification and was unrelated to the adequacy of user assets. User account balances are unaffected, and losses incurred from the incident will be absorbed by Bitget’s protection fund. Trading and deposit services continue to operate as normal. The announcement also confirmed that the situation is under control, with no further unauthorized transfers occurring. Bitget is continuing its investigation with assistance from Google-owned cybersecurity firm Mandiant and SlowMist.
The official announcements, originally marked in UTC, translate to the following schedule in Taiwan time:
The incident occurred at 2:31 AM Taiwan time on September 25, according to Bitget. This timeline indicates that Bitcoin withdrawals will have been suspended for approximately three and a half days before resuming, and all services will be fully restored in about seven and a half days. XRP is not included in the first three phases and will be reinstated along with other tokens on October 2. CEO Gracy Chen, in a post following a livestream on September 25, highlighted that XRP represented the single largest loss on a specific chain during the incident.
Bitget emphasized that the phased restoration order is consistent for all users, with no priority list. Users are not required to take any prior action, as the withdrawal availability for each currency will be directly displayed on the platform. Gracy Chen is scheduled to host a livestream AMA at 3:30 PM Taiwan time on September 28, half an hour before Bitcoin withdrawals reopen, to provide details on the incident and the progress of the recovery.
Prior to this schedule announcement, Gracy Chen had stated on September 25 that an announcement would be made once specific times were confirmed, avoiding commitments to unverified timelines. Another announcement from Bitget on the same day indicated that withdrawal schedules would be released by noon Taiwan time on September 26. The actual schedule was published at 3:55 AM Taiwan time on September 26, approximately eight hours ahead of the self-imposed deadline.
On September 25, based on on-chain tracking, Bitget revised the estimated amount transferred to attacker addresses to approximately $387.5 million, an increase of about $35.9 million from the initial estimate of $351.6 million. This discrepancy is attributed to previously uncounted assets on the Zcash and TRON chains. Affected cryptocurrencies include XRP, ETH, USDT, ZEC, USDC, BNB, AVAX, and TRX, among others.
According to Gracy Chen’s statement on September 25, Bitget’s protection fund exceeds $464 million and is held in publicly verifiable wallet addresses. The exchange also possesses over $1 billion in proprietary assets. Based on the revised loss figure, the protection fund is approximately $76.5 million greater than the losses, a reduction in buffer of about 30% compared to the initial estimate, where the difference was around $112 million.
Bitget has also launched a bug bounty program, offering a 5% reward to individuals or organizations that assist in freezing or recovering the stolen assets, primarily through collaboration with LazarusBounty on Bybit. The announcement noted that some of the stolen assets have already been frozen with industry assistance.
When will Bitget resume withdrawals?
Bitget is restoring withdrawals in four phases. Bitcoin withdrawals resumed at 4:00 PM Taiwan time on September 28. Ethereum withdrawals followed on September 29, USDT on September 30, and other tokens, fiat currencies, and P2P services are scheduled to resume at 4:00 PM on October 2.
Will user assets be affected by the Bitget hack?
Bitget has stated that user account balances are unaffected, and the approximately $387.5 million in losses will be covered by the protection fund. CEO Gracy Chen indicated that the protection fund exceeds $464 million, with an additional over $1 billion in proprietary assets.
