Bitget moved from a nearly $400 million security loss to resumed withdrawals and renewed inflows in a matter of days, according to details published after the Sept. 25 incident. The exchange ultimately confirmed that about $388 million in assets were affected. CEO Gracy Chen later said in a livestream that it was the first security incident of this kind in the platform’s eight-year operating history.
SlowMist said the earliest malicious activity it identified involved a zero-day vulnerability on a node tied to a third-party security product. Investigations by both Mandiant and SlowMist pointed to a compromise in third-party security infrastructure that eventually led into Bitget’s wallet environment.
After the incident, Bitget said losses would be covered by its user protection fund. The fund, created in 2022, held 5,500 BTC at the time, worth more than $464 million. Gracy Chen said the fund would be replenished within one week to $300 million, the baseline size set when it was established in 2022. That commitment had been fulfilled by Sept. 30, according to the report.
Withdrawals were then restored on the previously announced timetable. BTC withdrawals reopened first at 16:00 on Sept. 28. After ETH withdrawals resumed on Sept. 29, related hot wallets quickly shifted from net outflows to net inflows, and balances soon rose slightly above the level seen before withdrawals were reopened. By the time of publication, withdrawals for all tokens had resumed.
Attack route traced to a zero-day in a third-party security product
One of the central details in the incident is what did not happen: Bitget said private keys were not leaked, cold wallets were not compromised, and the event was not caused by a smart contract exploit. Based on the exchange’s disclosed findings, the entry point was a third-party security product used by the platform.
According to the published timeline, the earliest confirmed small transfers linked to the incident appeared on-chain at around 02:31 Beijing time on Sept. 25. Larger asset movements followed. In comments to The Block, Gracy Chen said that from 02:58 to 04:09, the attacker carried out 17 large transactions across Ethereum, XRP, Zcash, BNB Chain, Base, Arbitrum, Optimism, and Avalanche. After additional reconciliation, Bitget put the total impact at about $388 million.
At 03:05, roughly seven minutes after the first large transfer, Bitget’s reconciliation system detected a clear discrepancy in funds and triggered a platform-wide withdrawal block. At 03:14, the exchange activated its highest emergency response level. Because a private key leak had not yet been ruled out at that stage, the wallet team moved assets into cold wallets and shut down withdrawal and signing services.
The security team later identified the root cause. Under the attack chain disclosed so far, the attacker exploited a previously unknown zero-day vulnerability in a third-party security product. In practical terms, that means both the vendor and the user lacked prior knowledge of the flaw, and there was no available patch ready to deploy in advance.
Bitget said the attacker used the flaw to steal internal network credential material, forge withdrawal instructions to the wallet system, and trick the wallet into executing abnormal transfers that bypassed risk checks. Throughout the process, private keys were not exposed and cold wallets were not affected. Gracy Chen also said the attacker deleted part of the relevant traces after completing the operation, making forensic reconstruction more difficult.
Afterward, Bitget disabled the affected third-party functions, reissued internal credentials, revoked and re-split highly sensitive permissions, and added an independent verification step for withdrawals. Mandiant and SlowMist remain involved in independent forensic work and fund tracing.
The case also widens the discussion around exchange security boundaries. The report argues that the risk perimeter no longer ends with private keys and cold wallets. Security software, wallet infrastructure, and other third-party services that can reach core systems may also become viable entry points.
Protection fund absorbed the loss as withdrawals came back in phases
Once the loss was confirmed, Bitget tapped its protection fund. The fund was set up in 2022 and has long used $300 million as its benchmark size. At the time of the incident, the 5,500 BTC it held were worth more than $464 million, enough to cover the final loss amount of about $388 million. Bitget then said the financial impact of the incident would be borne by the protection fund and that user account balances would not be affected.
Even before BTC withdrawals resumed on Sept. 28, on-chain activity showed the fund starting to move assets into hot wallets. On-chain analyst Ai Yi tracked an initial transfer of 2,042.28 BTC from a related protection fund address into a Bitget hot wallet.
The report presents that as one of the more instructive parts of Bitget’s response. This was not an ad hoc compensation plan announced after the breach. The fund had already been established four years earlier, reserves were kept over the long term, wallet addresses were publicly traceable, and the fund had a stated benchmark size. After the incident, the reserves were actually used, then replenished back toward the original standard.
Gracy Chen said Bitget would refill the protection fund to at least $300 million within a week. Based on on-chain monitoring cited in the report, that happened on schedule. On Sept. 30, Bitget also released its 47th Proof of Reserves report, showing a total reserve ratio of 131% across 19 asset categories. The reserve ratios for BTC, ETH, USDT, and USDC were listed at 142%, 110%, 107%, and 154%, respectively.
Communication was another focal point over those days. Gracy Chen spent about three consecutive hours answering questions in a community livestream, while Xie Jiayin kept posting updates through social media and community channels. The significance was not the stream length itself but the fact that management stayed visible during the most chaotic period of the incident.
Several key statements also came with specific information or a next-step plan. The exchange quickly clarified that the protection fund would cover the losses. When the affected amount was revised from $351.6 million to $388 million, it explained why the number had changed. Before the attack route was confirmed, it did not rush to conclusions about the attacker’s identity or methods. Once the investigation progressed, it disclosed more details about the third-party security product, the zero-day flaw, high-privilege credentials, and forged withdrawal instructions.
The withdrawal recovery process followed the same pattern. Because the incident involved multiple tokens and multiple networks, the review was not limited to a single wallet. Bitget did not restore all withdrawals at once. It reopened them in stages after checking each relevant wallet, network, and risk condition.
- On Sept. 26, the exchange published a detailed recovery schedule.
- BTC withdrawals resumed on Sept. 28.
- ETH and related networks resumed on Sept. 29.
- USDT and related networks resumed on Sept. 30.
- Other tokens, fiat, and C2C services were scheduled to return on Oct. 2.
According to the report, all of those services had resumed on schedule by publication time.
Given that the breach spanned several assets, several networks, third-party software, and internal permissions, the exchange’s approach was to publish date-specific recovery targets first and then deliver on them one by one.
On-chain flows turned after ETH withdrawals resumed
After ETH withdrawals returned on Sept. 29, on-chain data showed an early shift. Ai Yi said a related hot wallet prepared for ETH withdrawals climbed back above 30,000 ETH within half an hour of reopening, moving above its initial level.
Bitget later published platform figures showing that in the first hour after withdrawals resumed, ETH inflows reached about 9,674 ETH while outflows were about 9,023 ETH, leaving a net inflow of roughly 651 ETH. Data for Sept. 30 showed $231 million in platform inflows over 24 hours, close to the exchange’s average daily inflow of $245 million in August this year. The report said that meant the one-way outflow some had feared did not take shape.
Bitget also rolled out a set of user incentive programs after withdrawals resumed. ETH PoolX offered a 500,000 USDT reward pool for users who locked ETH, and the early campaign page briefly showed an estimated APR of about 37.11% before the rate moved lower as more capital joined. BTC PoolX followed with a 100,000 BGB reward pool and extra boosts tied to users’ BTC holdings over the previous 15 days.
On the stablecoin side, Bitget introduced flexible savings products for USDT and USDGO, allowing deposits and withdrawals at any time, with promotional APRs of 10% and 12%, respectively. Its "Peer Plan" placed 30% of eligible trading fee revenue during the campaign period into a user reward pool, with 60% allocated by trading volume and 40% by asset size. On Oct. 2, official Bitget data showed the first batch of rewards had been distributed, with 1,907,455 USDT paid out to 763,543 users.
In the report’s framing, resumed withdrawals addressed whether users could leave with their funds. The incentives that followed focused on restarting trading activity, wealth products, and capital retention. Days earlier, the market’s central question had been when withdrawals would reopen. After services returned, attention shifted toward which campaign offered the higher APR.
For an exchange, one of the clearest signs of confidence returning is that users still keep funds on the platform when they are free to move them elsewhere.
Industry support extended beyond Bitget itself
The incident also drew visible support from across the industry. One of the examples highlighted in the report came from Bybit. In February 2025, Bybit suffered a security incident involving about $1.4 billion. Roughly five hours after that attack, Bitget sent 40,000 ETH to Bybit, worth more than $100 million at the time. Those 40,000 ETH carried no interest, no collateral requirement, and no fixed repayment deadline. Bybit repaid the full amount within three days.
More than a year later, the positions reversed. After Bitget was hit, Bybit CEO Ben Zhou quickly said publicly that he was willing to help and added, "Bitget helped us when we were hacked." Bybit then added the related stolen funds to its LazarusBounty tracking system.
Support did not stop there. CZ publicly voiced support after the incident. Binance’s security team then worked with Bitget on threat intelligence sharing, stolen-fund tracing, and support for asset recovery. MEXC CEO Vugar Usi also contacted Bitget to offer support. Outside the exchange sector, Mandiant and SlowMist took part in investigation and forensics, while Circle and Tether were involved in freezing relevant assets.
The broader implication in the report is that the crypto industry, despite intense competition, is also building its own response network for extreme events. That network includes protection funds, cooperation between exchanges, security firms, and on-chain tracking. At the same time, the defensive perimeter exchanges must manage keeps expanding from hot wallets and signing systems to third-party software and internal permissions.
The article argues that maintaining a protection fund, staying public and transparent after an incident, honoring stated commitments, and working with industry peers now form a workable crisis-response pattern. As ETFs, stablecoins, RWA, and tokenized securities bring more traditional financial capital into crypto, and as the U.S. regulatory framework continues to take shape, the industry is being judged not only on innovation and growth but also on its ability to manage risk.
In Bitget’s case, the turning points came from three concrete steps: the protection fund absorbed the loss, withdrawals resumed on schedule, and platform flows recovered after services returned. For a sector moving closer to mainstream finance, the test is less about assuming that nothing will ever go wrong and more about whether platforms can pay, explain, and recover when a bad day arrives.