Bitget Hacked for $387 Million: When Withdrawals Reopen and What to Do Now (2026)
Update — October 2, 2026
Bitget says its phased withdrawal resumption is now complete. In an official announcement at 08:00 UTC on October 2, the exchange said withdrawals for all remaining tokens, along with fiat and C2C (P2P) services, have reopened. This follows the earlier phases, all confirmed by Bitget announcements: BTC on September 28, ETH on Ethereum, BNB Chain, Arbitrum, Base and Optimism on September 29, and USDT on Ethereum, BNB Chain, Solana and Tron on September 30. One caveat: about 20 minutes later, Bitget separately suspended DOGE, LTC and BCH network withdrawals for wallet maintenance, with no reopening date announced yet. If you hold those coins, check the withdrawal page in the app before moving funds.
Bitget detected unauthorised transfers out of its hot and warm wallets at 18:31 UTC on September 24, 2026. The figure first given was $351.6 million and was later raised to roughly $387.5 million. Withdrawals were suspended the same day. Bitget says private keys were never compromised, that the attacker spoofed transaction data to push payments through the exchange’s own authorisation process, and that its User Protection Fund covers the full loss. Withdrawals restart in stages from September 28, 08:00 UTC, with full restoration expected by October 2, 08:00 UTC. Deposits and trading stayed open throughout.
Disclosure: we run a fee-rebate comparison site that lists Bitget among other exchanges, so we have a commercial relationship with the subject of this article. We have written it the way we would want to read it if our own money were sitting on the platform.
Jump to a Section
- What Actually Happened?
- When Do Withdrawals Come Back?
- Are User Balances Actually Covered?
- Who Did It, and Is That Confirmed?
- What Should You Do Right Now?
- What This Says About Keeping Funds on Any Exchange
What Actually Happened?
Bitget’s monitoring flagged unauthorised transfers leaving some of its hot wallets at 18:31 UTC on September 24, 2026. Hot and warm wallets were affected. Cold storage, which holds the bulk of platform assets, was not.
The attack did not work the way most exchange breaches do. According to Bitget, the attacker got into a wallet back-end system, produced spoofed transaction data, and used that to trigger the exchange’s own authorisation process. The withdrawals were approved because the system believed they were legitimate.
Chief executive Gracy Chen described it as “the digital version of slipping forged withdrawal slips through a bank’s own teller window,” and stated that “private key compromise has been ruled out.”
That distinction matters for what comes next. A stolen private key means the keys must be rotated and every address is suspect. A forged-instruction attack means the flaw sits in the approval logic, which is a software fix. Bitget says the vulnerability has been patched. Google’s Mandiant and the blockchain security firm SlowMist are involved in the investigation, and Circle and Tether have frozen assets sitting in the attacker’s wallet.
One detail worth noting plainly: the loss figure moved. The first public number was $351.6 million. It was later revised upward to roughly $387.5 million across multiple networks. Revisions in the days after an incident are normal as tracing completes, and the number may move again.
When Do Withdrawals Come Back?
Bitget’s own support notice says withdrawals “will resume in phased stages beginning September 28, 2026, 08:00 UTC, with full restoration expected by October 2, 2026, 08:00 UTC.”
The per-network breakdown below comes from reporting on Bitget’s announcement rather than from the support page itself, so treat the intermediate dates as indicative and confirm in the app before planning around them.
| Date (UTC) | What reportedly reopens |
|---|---|
| Sep 28, 08:00 | BTC on the Bitcoin network |
| Sep 29, 08:00 | ETH on Ethereum, BNB Smart Chain, Arbitrum, Base, Optimism |
| Sep 30, 08:00 | USDT on Ethereum, BNB Smart Chain, Solana, Tron |
| Oct 2, 08:00 | Remaining tokens, fiat, and peer-to-peer |
Chen was explicit about not over-promising on timing: “We will not commit to a window we cannot guarantee.” Read that as a reason to plan for slippage rather than as a reason to distrust the schedule.
Throughout the suspension, deposits and trading remained open. That is worth knowing before you act — being unable to withdraw is not the same as being unable to close a position.
Are User Balances Actually Covered?
Bitget says yes. Its User Protection Fund holds 5,500 BTC, worth roughly $464 million at the time of the incident, and the company states the fund covers the full loss. Chen’s wording was direct: “User funds are safe. Your account balances are accurate and your assets are protected.”
Two things are true at once here, and it is worth holding both. The fund is real, publicly attested and larger than the loss, which is a materially better position than exchanges that have had incidents of this size without one. At the same time, this is the exchange’s own statement about the exchange’s own solvency, and no external audit of the post-incident balance sheet has been published. You are extending trust either way; the fund reduces how much trust is required, it does not remove the need for it.
The practical test is not the announcement. It is whether withdrawals actually clear at normal speed once each phase opens.
Who Did It, and Is That Confirmed?
Several outlets have reported suspicion that the North Korea-linked Lazarus Group was behind the attack, based on the pattern of the intrusion and the movement of funds afterwards.
That attribution is not confirmed. It is a working hypothesis reported by security researchers and press, not a finding published by Bitget or by the investigators it has engaged. Attribution in crypto theft frequently shifts, and early consensus has been wrong before. Treat it as context, not as fact, and do not let it change your decisions — who took the money makes no difference to whether you can withdraw it.
What Should You Do Right Now?
There is no universal answer, but there is a sensible order of operations.
- Check your balance in the app, not in a screenshot. Bitget says balances are accurate. Confirm yours matches what you expect before doing anything else.
- Do not rush to close positions because of the news. Trading stayed open, so a panicked exit is a trading decision you are making under stress, not a safety measure. Liquidity and spreads can be worse in the hours after an incident.
- Know which phase your asset falls into. If you hold USDT, your window is later than someone holding BTC. Plan around the date that applies to you rather than the first date in the schedule.
- Expect queues on reopening. When withdrawals restart after a suspension, everyone tries at once. A delayed withdrawal on day one is not evidence of a second problem.
- If you were already planning to reduce exchange balances, this is a reasonable prompt. Not because Bitget specifically failed to cover it, but because the incident is a reminder of what custody means.
What This Says About Keeping Funds on Any Exchange
The uncomfortable part of this incident is not that an exchange was attacked. It is how it was attacked. The private keys held. The cold storage held. The attacker still moved hundreds of millions because the system that decides “is this withdrawal legitimate” could be fooled.
That failure mode is not specific to Bitget and no amount of reading an exchange’s security page would have predicted it. Which is the argument for the boring advice: keep on an exchange what you need for trading, and keep the rest where an approval system cannot be tricked into moving it.
It is also an argument for judging an exchange on how it behaves in the days after an incident rather than on its marketing before one. The things worth watching here are whether each withdrawal phase opens on time, whether the loss figure settles, and whether a post-incident report with external verification follows.
🔗 Related
- Bitget Fee Discount and Payback Stacked: How 0.06% Becomes 0.015% — our earlier cost breakdown, written before this incident
- Liquidated Before Your Stop-Loss? Why That Happens
FAQ
Can I still trade on Bitget right now?
Yes. Deposits and trading stayed open through the withdrawal suspension. Only withdrawals were paused.
Will I get my money back if my balance was affected?
Bitget states that user balances were not reduced and that its User Protection Fund absorbs the platform-level loss. If your balance does not match what you expect, raise a support ticket rather than relying on general statements.
Is the $387.5 million figure final?
Probably not. It was revised up from $351.6 million once tracing progressed. Numbers in the first week after an incident normally move.
Does this affect my Bitget fee rebates or referral earnings?
Nothing published addresses rebate accrual specifically. Trading continued, so trading-based accruals presumably continued with it, but confirm in your own account rather than assuming.
Should I move to another exchange?
That depends on why you were on Bitget in the first place and on whether the withdrawal phases open on schedule. Moving during a suspension is not possible anyway, and moving on day one of reopening means joining the queue. There is no urgency that the schedule does not already impose.
Sources
- Bitget Support — Withdrawal Service Update (September 24, 2026). Source of the phased resumption window and the detection timestamp.
- CoinDesk — Bitget’s $351 million hack happened via spoofed transfers, not private keys, CEO says. Source of the CEO quotes and attack description.
- BleepingComputer — Hackers steal $351.6 million in Bitget crypto exchange hack.
- Hackread — Bitget confirms hack, suspects North Korea’s Lazarus Group. Attribution reporting, unconfirmed.
Reported from public sources as of September 26, 2026. This is a developing incident and figures, timings and attribution may change after publication — check Bitget’s own announcement page for the current position before acting. This article is informational and is not financial advice. Cryptocurrency trading carries risk, and leveraged trading can result in the loss of your entire principal.
