Bitget eats the loss instead of passing it to customers
Bitget is absorbing the cost of its $387.5 million breach rather than leaving users to cover the gap. The exchange’s risk protection fund paid out the full loss, and Bitget has committed to refilling that fund to at least $300 million within seven days using its own capital, according to Gate.com. That decision, not just the return of withdrawals, is what determines whether customers keep trusting the exchange with their funds.
To make Monday’s Bitcoin withdrawals possible, Bitget moved 3,630 BTC, worth roughly $300 million, from cold storage into hot wallets, per Gate.com. Within the first hour of reopening BTC withdrawals at 16:00, the exchange processed more than 6,000 requests totaling about 2,700 BTC, or roughly $220 million, Gate.com reported. That is real money leaving the platform in real time, a direct test of whether Bitget’s fixes hold.
Key Takeaways
- Bitget resumed Bitcoin withdrawals Monday after a Sept. 24 hack, with the stolen total revised to $387.5 million from an initial $351.6 million.
- The exchange moved 3,630 BTC (about $300 million) from cold to hot wallets and processed over 6,000 withdrawal requests, roughly $220 million, in the first hour, according to Gate.com.
- Bitget’s risk fund covered the loss, and the exchange pledged to replenish it to at least $300 million within seven days from its own capital.
- Ether withdrawals return Tuesday and USDT on Wednesday, with no priority access for institutions, VIP accounts or Bitget employees.
- CEO Gracy Chen said a third-party security product’s vulnerability let an attacker obtain high-level internal credentials to issue fraudulent withdrawal commands, while private keys and cold wallets stayed secure.
What broke, and what Bitget says it fixed
The Sept. 24 breach hit Bitget’s hot and warm wallet infrastructure while cold wallets stayed secure, the exchange said, according to Cointelegraph. Chen later gave a more specific account of the entry point: a vulnerability in a third-party security product allowed the attacker to obtain high-level internal credentials, which were then used to issue fraudulent withdrawal commands, she told Cointelegraph. Bitget’s private keys were never compromised, Chen said.
Bitget says it has since closed that gap. The exchange restricted internal access, added independent verification for withdrawals and increased monitoring for unusual activity, according to Cointelegraph’s reporting on Chen’s comments. The company has not disclosed how much of the stolen crypto has been recovered or frozen, though Chen said some assets have been frozen with help from other industry participants, with a full figure to come once amounts are verified.
Investigators are also still working through who was behind the attack. Chen said earlier suspicion of a North Korea link was based on preliminary indicators that are still being assessed, with Mandiant and SlowMist supporting the forensic investigation, per Cointelegraph.
Recovery schedule treats every account the same
Bitget’s phased return of services carries a competitive signal: no customer segment gets to withdraw first. BTC withdrawals on the Bitcoin network and BNB Smart Chain came back Monday, and the schedule that follows applies equally to institutions, VIP customers and Bitget employees, Chen said during a Monday ask-me-anything session, according to Cointelegraph.
Ether withdrawals are set to resume Tuesday across Ethereum, BNB Smart Chain, Arbitrum, Base and Optimism, followed by USDT on Wednesday across Ethereum, BNB Smart Chain, Solana and Tron. Withdrawals for other assets and peer-to-peer services return Friday. “We restored BTC first because the withdrawal pipeline is the first to be completed,” Chen said.
THORChain pushback tests what a protocol can actually block
Bitget’s attempt to choke off the attacker’s exit ran into the limits of decentralized infrastructure. Lookonchain reported Monday that the attacker was swapping Ether for Bitcoin through THORChain, with Arkham data showing attacker-linked ETH flowing into THORChain vaults, per Cointelegraph. Chen had called on THORChain to refuse service to addresses tied to the attack, but the protocol said Monday that its network halt is a broad emergency mechanism and “is not a selective freeze of specific funds or an individual swap.”
Crypto author Anndy Lian said THORChain can halt trading, stop outbound transactions or pause a connected chain, but each of those tools affects all users on the network, not just the attacker, according to Cointelegraph. The protocol has no built-in address blacklist, limiting how precisely it can target stolen funds, Lian said. Chen has since clarified that Bitget is not asking THORChain to halt its network outright, telling Cointelegraph the exchange respects “the technical constraints of different networks” and is “not asking any protocol to take actions that are not technically possible.”
What to Watch
Ether withdrawals resume Tuesday and USDT on Wednesday, with other assets and peer-to-peer services following Friday, per Bitget’s published schedule. Bitget has seven days from its pledge to rebuild its risk fund to at least $300 million from its own capital, and the exchange has yet to disclose how much of the stolen assets have been recovered or frozen, or the final outcome of the North Korea link Mandiant and SlowMist are still investigating.
