Bitget says it will gradually restore crypto withdrawals after a security incident caused the loss of roughly $351.6 million from parts of its hot- and warm-wallet infrastructure.
Withdrawals to Resume in Phases
The exchange said withdrawals will return in stages after additional security checks and testing are completed.
Bitcoin withdrawals are scheduled to reopen first on September 28 at 08:00 UTC, followed by Ethereum on September 29. USDT withdrawals are expected to return on September 30, while other tokens, fiat withdrawals, and P2P services are planned to resume by October 2.
Bitget said its security and technical teams have identified and fixed the vulnerability involved in the attack. The company is now conducting further tests across its withdrawal systems before restoring services.
Bitget will begin resuming withdrawals in orderly phases following the security incident on Sep 24. Thank you all for your patience. Please understand that due to the different nature of this incident (which involves multiple blockchains and multiple cryptocurrencies), we are… https://t.co/XfdPsIIRiR
— Gracy Chen @Bitget (@GracyBitget) September 26, 2026
“The vulnerability involved in the incident has been identified and remediated,” Bitget said on X.
According to the exchange, the withdrawal suspension was introduced as a precaution while the incident was investigated. Bitget also said customer balances were not affected by the attack.
The company stated that the pause does not indicate any issue with the availability of user funds.
Protection Fund to Cover Losses
Bitget CEO Gracy Chen said the exchange’s Protection Fund will cover the financial impact of the incident. She previously said the fund held more than $464 million.
The breach was limited to certain hot and warm wallets, while Bitget’s cold-wallet infrastructure remained secure, according to Chen. Trading and deposits therefore continued to operate during the incident.
Circle and Tether Freeze Part of the Stolen Funds
Stablecoin issuers Circle and Tether have also taken action against addresses associated with the exploit.
The address identified as “Bitget Exploiter 8” was blacklisted, resulting in the freezing of approximately 218,023 USDT and 99,990 USDC, worth around $318,000 combined.
Chen thanked both companies for responding quickly, saying that every frozen address could help with the recovery effort.
Bitget has also introduced a Recovery Bounty Program. Under the program, the exchange is offering a 5% incentive related to freezing attacker-controlled funds, along with a 5% discount tied to asset recovery.
XRP Among the Largest Assets Stolen
XRP accounted for a substantial portion of the stolen assets. Reports indicate that approximately $157.5 million worth of XRP was taken, making it the largest single asset involved in the incident.
Thank you to Circle and Tether for moving quickly. Every address frozen matters.
To the broader community: Bitget’s Recovery Bounty Program is live — 5% for freezing attacker funds, 5% for recovery. Every exchange, security researcher, and onchain investigator can make a… https://t.co/UrFjceBL49
— Gracy Chen @Bitget (@GracyBitget) September 26, 2026
Ethereum was another major asset affected. Investigators say the attackers moved funds across multiple networks and converted part of their holdings into ETH.
Bitget maintains that the incident has been contained and that further unauthorized transfers are no longer possible.
Blockchain security firms Mandiant and SlowMist are assisting with the investigation. Bitget also said users will not need to take any additional action before withdrawals become available again.
The exchange said users will be able to see withdrawal availability directly on the Bitget platform.
Lazarus Group Attribution Still Under Investigation
There has also been speculation that the Lazarus Group, a hacking organization linked by authorities to North Korea, could be connected to the incident.
Chen and some blockchain security researchers have raised the possibility, but the attribution remains under investigation and has not been conclusively established.
