Bitget taps the brakes on a $388M heist, now slowly reopening the withdrawal gates 🚪

Crypto exchange Bitget is gradually resuming withdrawals after a Sept. 24 security breach that initially impacted $351.6 million in assets and was later revised to $387.5 million after accounting for additional transfers on Zcash and Tron. The exchange said its cold wallets remained secure and that private keys were not compromised, with the attacker instead gaining access to high-level internal credentials by exploiting a third-party security tool, a flaw the company says has been patched. Bitcoin ($BTC) withdrawals resumed first on Monday across the Bitcoin network and BNB Smart Chain, according to Bitget CEO Gracy Chen, who said in a Monday ask-me-anything session that "We restored BTC first because the withdrawal pipeline is the first to be completed."

Ether ($ETH) withdrawals are scheduled to resume Tuesday across Ethereum, BNB Smart Chain, Arbitrum, Base and Optimism, followed by Tether's USDt ($USDT) on Wednesday across Ethereum, BNB Smart Chain, Solana and Tron, with all other assets and peer-to-peer services set to return Friday. Chen said the schedule applies to all users, with no priority access for institutions, VIP customers or Bitget employees. Mandiant and SlowMist are assisting with the forensic investigation, and Bitget said it is working with law enforcement, other exchanges, blockchain projects and security experts to trace and recover funds, with some impacted assets already frozen through industry coordination.

The attacker has continued moving stolen funds through the decentralized cross-chain protocol THORChain, swapping Ether for Bitcoin, according to blockchain investigator Lookonchain and Arkham-labeled wallet data. Chen called on THORChain to refuse services to addresses linked to the attack, but THORChain said Monday that its network halt is an emergency security mechanism that affects the protocol broadly and "is not a selective freeze of specific funds or an individual swap." On Wednesday, blockchain investigator ZachXBT reported that wallets tied to the hack moved about $3.8 million in Zcash ($ZEC) into the network's Ironwood pool, representing roughly 14% of the 18,917 ZEC stolen.

Bitget's Protection Fund, initially established in January 2022 with 5,500 BTC, reached $309 million, and Chen said "The Protection Fund was created for moments like this and absorbed the financial impact of the incident." Speaking to Cointelegraph this week, Chen said Bitget has not ruled out possibilities including an inside job or North Korean hackers, and the exchange has launched a bounty program offering 5% of frozen funds and 5% of any recovered funds. Bitget posted on Wednesday that withdrawals for all tokens would resume Friday and that the exchange was "gradually back to usual," with user account balances unaffected throughout the phased restoration.