Bitget has resumed withdrawals in stages after a September 24 security breach drained roughly $388 million from its operational wallets, and users have already pulled about $463 million in the first 24 hours of the reopened windows.

The attack exploited a zero-day vulnerability in a third-party security application, according to the exchange. Attackers spoofed transactions after obtaining internal credentials. Bitget says private keys and cold wallets were never compromised.

The exchange suspended withdrawals immediately after detecting the breach while keeping trading and deposits live. The resumption followed a phased schedule: Bitcoin withdrawals returned on September 28, Ethereum on September 29, and USDT on September 30. Other assets and peer-to-peer transactions are targeted for October 2. Bitget processed more than 4,098 BTC in withdrawals shortly after the Bitcoin window reopened.

The exchange's tracked reserves have dropped to around $5.7 billion. Before the hack, Bitget's total balance sat above $6.7 billion, meaning the theft itself represented roughly 5–6% of total reserves.

The protection fund buffer

CEO Gracy Chen moved quickly to reassure users that account balances would remain whole. Bitget is absorbing the loss through its User Protection Fund, which was valued at over $464 million before the incident. The fund's pre-breach size was just large enough to cover the $388 million theft with some cushion remaining.

On the investigation side, Bitget has engaged Mandiant and SlowMist to trace the stolen funds and identify the attackers. Initial assessments suggest potential involvement from North Korea-linked hacking groups, which would place the breach in the pattern of state-sponsored crypto theft that has defined exchange security incidents in recent years.

The outflow problem

The $463 million in customer outflows within 24 hours of resumption tells a story no CEO statement can fully counteract. Total balances have declined roughly $600 million since the day before withdrawals reopened, combining the theft itself with voluntary outflows — a dual hit to the exchange's balance sheet and its user base.

The phased withdrawal approach is a pragmatic operational choice. Reopening everything at once risked a bank-run dynamic, while a controlled rollout gives the exchange time to manage liquidity across chains and demonstrate stability.

Supply-chain exposure

The zero-day vector originated in a third-party application rather than Bitget's own infrastructure. That raises questions about supply-chain security standards that most regulatory frameworks have not yet addressed, and it suggests the industry's risk surface extends well beyond exchange codebases.

For Bitget, the recovery path is concrete but narrow. The exchange must fully restore withdrawals on schedule by October 2, demonstrate that the protection fund has made every user whole, and produce credible forensic findings from Mandiant and SlowMist. The remaining $5.7 billion in reserves gives it substantial room to operate, but the $463 million that left in a single day represents users who voted with their wallets. Whether the October 2 deadline holds, and what the forensic teams recover, will determine whether this incident becomes a contained loss or a lasting structural break in user confidence.