Crypto exchange Bitget said the vulnerability involved in its recent hack has been identified and patched, with withdrawals set to resume in four stages. Under the schedule converted to Taiwan time, Bitcoin withdrawals will reopen first at 16:00 on Sept. 28, Ethereum-related networks will follow on Sept. 29, USDT withdrawals on Sept. 30, and all other tokens, fiat, and P2P services on Oct. 2 at 16:00.
In an announcement released early on Sept. 26 Taiwan time, Bitget said the withdrawal freeze was imposed to complete a final round of security verification and was unrelated to whether user assets were sufficiently backed. The exchange said user account balances were unaffected, losses from the incident would be covered by the Bitget Protection Fund, and trading and deposits continue to operate as usual. It also said the event has been contained and that there will be no further unauthorized transfers. Google-owned cybersecurity company Mandiant and SlowMist are continuing to assist with the investigation.
Withdrawal reopening schedule
Bitget published the timeline in UTC. Converted to Taiwan time, the four phases are:
- Sept. 28, 16:00: BTC on the Bitcoin network
- Sept. 29, 16:00: ETH on Ethereum, BSC, Arbitrum, Base, and Optimism
- Sept. 30, 16:00: USDT on Ethereum, BSC, Solana, and Tron
- Oct. 2, 16:00: all other tokens, fiat, and P2P
Bitget said the incident took place at 02:31 Taiwan time on Sept. 25. Based on that timestamp, Bitcoin withdrawals will have been paused for about three and a half days by the time they reopen, while a full restoration of services will take about seven and a half days.
XRP is not included in the first three phases and will remain unavailable until Oct. 2 with the rest of the tokens. Bitget CEO Gracy Chen said in a Sept. 25 post after a livestream that XRP was the asset with the biggest loss on a single chain in the incident.
No priority list for withdrawal access
Bitget said the phased order will apply equally to all users, with no priority list. Users do not need to complete any advance steps. Whether a token is available for withdrawal will be shown directly on the platform.
Chen is also scheduled to host a live AMA at 15:30 Taiwan time on Sept. 28, half an hour before Bitcoin withdrawals reopen, to explain what happened and provide an update on the recovery process.
Before this timetable was released, Chen said on Sept. 25 that Bitget would announce the schedule only after confirming the exact timing and would not promise deadlines it could not meet. In another notice on the same day, Bitget said it would publish the withdrawal plan before noon Taiwan time on Sept. 26. The actual schedule was posted at 03:55 on Sept. 26, about eight hours ahead of that deadline.
Loss estimate revised to about $387.5 million
On Sept. 25, Bitget revised the value of assets transferred to attacker-controlled addresses to about $387.5 million based on on-chain tracking, up roughly $35.9 million from its initial estimate of about $351.6 million. The exchange said the increase came from previously uncounted assets on the Zcash and TRON networks.
Assets affected include XRP, ETH, USDT, ZEC, USDC, BNB, AVAX, and TRX. According to Chen on Sept. 25, the Bitget Protection Fund holds more than $464 million, all in publicly verifiable wallet addresses, and the company also has more than $1 billion in its own assets.
Using the revised loss figure, the protection fund exceeds the loss by about $76.5 million. Under the initial estimate, that gap was about $112 million, which means the buffer narrowed by about 30% after the loss figure was raised.
Recovery bounty plan launched
Bitget also introduced a recovery bounty program. The company said individuals or institutions that help freeze or recover stolen assets can receive 5% of the amount involved, with Bybit's LazarusBounty serving as the main cooperation channel. The announcement added that some stolen assets have already been frozen with help from industry participants.
Key points on withdrawals and customer assets
When will Bitget resume withdrawals?
Bitget will restore withdrawals in four stages. Bitcoin comes first at 16:00 Taiwan time on Sept. 28, Ethereum-related networks follow on Sept. 29, USDT on Sept. 30, and other tokens, fiat, and P2P on Oct. 2 at 16:00.
Will user assets be affected after the hack?
Bitget said user account balances are unaffected and that the roughly $387.5 million loss will be covered by the protection fund. Chen said the fund is worth more than $464 million, and Bitget also has more than $1 billion in company-owned assets.