Bitget began letting customers pull Bitcoin off the exchange again at 08:00 UTC on September 28, four days after someone drained roughly $387.5 million from part of its hot-wallet infrastructure. The exchange had suspended withdrawals on September 24 after detecting unauthorized transfers at 18:31 UTC that day.
The return is phased. ETH withdrawals are scheduled for September 29, USDT for September 30, and the leftovers — other tokens, fiat, and peer-to-peer services — on October 2. Trading and deposits never stopped.
How the loss number grew
Bitget's first estimate put the damage at $351.6 million. A day later it revised the figure to about $387.5 million. That bump wasn't a second breach, the exchange said in its September 25 incident update: the higher number folded in additional Zcash and TRON transactions tied to the same event.
Cold wallets, Bitget said, were untouched. So was Bitget Wallet, the exchange's separate self-custodial product, according to The Block.
The distinction matters. Hot wallets are custodial and sit connected to the internet — which is exactly what made them reachable. Cold storage is kept offline, away from the systems an attacker can touch. Bitget is drawing the line there, and so far no evidence has surfaced that pushes past it.
The four-day gap
Four days is a long time to have withdrawals frozen, especially when deposits and order books stay live. Users could add funds and trade them. They just couldn't take anything out. For an exchange, that's an awkward position: the platform looks functional right up until someone tries to leave.
Bitget published the reopening schedule in a September 26 support update. What that update didn't say is whether individual withdrawal limits or other conditions would apply once services resume. That omission is doing a lot of work right now — a phased restart with unspecified caps is not the same as a full all-clear.
What the forensics team is doing
Mandiant and SlowMist are still on the case, supporting the forensic work and trying to trace where the funds went. Bitget says it has identified and remediated the vulnerability behind the incident. Neither firm's findings were detailed in the September 26 update, so the public picture of how the wallets were actually compromised is still thin.
The tracing effort is the part worth watching. Recovering stolen crypto is slow, partial, and often public — and any movement of those addresses will be visible on-chain long before Bitget says anything about it.
What's left on the calendar
ETH withdrawals due September 29 are the next checkpoint, and the first real test of whether the phased plan holds. USDT on September 30 and the broader October 2 window follow after that.
Two questions remain open: whether withdrawal limits get imposed when the doors open, and what Mandiant and SlowMist eventually conclude about how the breach happened in the first place.
