The latest security incident at Bitget has once again exposed one of the cryptocurrency industry’s most persistent challenges: even sophisticated exchanges can become vulnerable when weaknesses emerge somewhere in the technology stack.
Attackers exploited a vulnerability in a third-party security product, according to Bitget CEO Gracy Chen, allowing them to obtain internal network credentials, forge withdrawal instructions and bypass risk controls. The resulting loss has been estimated at roughly $387.5 million, up from an initial estimate of $351.6 million.
The incident was detected on September 24, when Bitget identified unauthorized transfers involving parts of its hot and warm wallet infrastructure. The exchange says its cold wallets were not affected and that customer account balances remained intact.
Register for the next Tekedia Mini-MBA.
Register for Tekedia AI in Business Masterclass.
Join Tekedia Capital Syndicate and co-invest in great global startups.
Bitget also says the incident was contained, with no further unauthorized transfers identified after the attack path was addressed. The significance of the breach extends beyond the amount stolen.
The reported attack demonstrates how crypto security increasingly depends on interconnected systems rather than simply protecting private keys. In this case, Bitget says the attackers exploited a third-party vulnerability to compromise internal credentials and manipulate the withdrawal authorization process.
That distinction matters because it shows how an exchange can face systemic risk even when its core cold-storage infrastructure remains secure. Bitget has since identified and remediated the underlying vulnerability.
The exchange has brought in cybersecurity specialists Mandiant and SlowMist to assist with forensic investigation, fund tracing and additional security checks. Trading and deposits have continued, while withdrawals were temporarily suspended as the company reviewed the withdrawal infrastructure.
The restoration of withdrawals is being handled in stages rather than through an immediate reopening. Bitcoin withdrawals are scheduled to resume on September 28 at 08:00 UTC. Ethereum follows on September 29 across Ethereum, BNB Chain, Arbitrum, Base and Optimism.
USDT withdrawals are scheduled for September 30 across Ethereum, Solana, TRON and other supported networks, while other tokens, fiat and P2P services are scheduled to return on October 2. The phased approach reflects the security priorities following a major breach.
Reopening withdrawals too quickly could create additional vulnerabilities if the underlying systems had not been fully validated. By restoring assets and networks progressively, Bitget can conduct further checks while monitoring the system for abnormal activity.
At the same time, the exchange has shifted attention toward recovering the stolen assets. Bitget launched a Recovery Bounty Program offering eligible participants a bounty equivalent to 5% of funds successfully frozen through their voluntary efforts and another 5% of funds successfully recovered.
The programme is designed to encourage exchanges, blockchain projects, security researchers and on-chain investigators to cooperate in tracing the stolen assets. The incident therefore illustrates both the vulnerability and resilience of modern crypto infrastructure.
Blockchain transactions may be transparent and traceable, but the surrounding systems that authorize transactions, manage credentials and connect multiple networks remain critical attack surfaces.
For Bitget, the immediate priorities are restoring withdrawals safely, recovering assets and demonstrating that the vulnerability has been permanently addressed. For the wider industry, the episode reinforces a broader lesson.
Exchange security is no longer only about protecting wallets. It is about securing every layer of the infrastructure that connects users, software, custodians, networks and financial assets.