Unauthorised transfers from Bitget's hot wallets, about 387.5 million dollars: on 30 September the interim findings of the two independent investigations, Mandiant and SlowMist, were released, and they say the attacker had been inside since 31 August — twenty-five days before the money moved — through two third-party security products, one hit with a zero-day. The vendor is not named and there is no CVE, so nobody else can patch the same flaw. As of 4 October withdrawals are open across all four tranches: the official incident page, updated at 00:00 UTC on 4 October and re-read by us at 12:10 UTC, marks the last one too — other tokens, fiat and P2P — as «Resumed», dated 2 October at 08:00 UTC. That is the confirmation that had not come for two days, and it comes from the company: no outlet reports it, there was no dedicated announcement, and the word used is «gradually». Everything else remains open: the frozen total the CEO gave CNBC is about 1.1 million dollars, 0.28% of the loss, and it was frozen by Circle, Tether and NEAR Intents, not by the exchange; the protection fund is back above 314 million (3,705 BTC), still below the declared loss and far from the 464 million it held before the attack; the company's own written technical report, ten days on, still does not exist
· $388M
On 24 September 2026 at 18:31 UTC, Bitget's security systems detected unauthorised transfers from some of the exchange's hot wallets. Three hours later, at 21:30 UTC, CEO Gracy Chen published the official notice: funds involved estimated at about 351.6 million dollars, cold wallets declared intact ("Bitget operates a three-tier wallet architecture — the breach affected only portions of the hot and warm layers"), the loss declared covered by the User Protection Fund. Deposits and trading never stopped; withdrawals were suspended as a precaution.
THE VECTOR. At 00:43 UTC on 25 September the CEO stated that "the attacker compromised a critical backend system within our wallet infrastructure, used it to spoof transaction data and triggered our authorisation process to move funds out". The transfers, in other words, were signed by the exchange's normal procedure, which saw them as legitimate: that is the difference between a breached signing setup and a deceived one. The company declares private key theft ruled out and, on 26 September, declares the vulnerability "identified and remediated", with the investigation supported by two independent third-party firms, Mandiant and SlowMist.
THE FIGURE WENT UP, BUT NOT BECAUSE MORE MONEY WAS STOLEN. On 25 September at 14:03 UTC Bitget revised the total from 351.6 to about 387.5 million dollars, and explained why: "the revised figure reflects a more complete accounting of transfers that occurred during the incident, adding affected assets on Zcash and TRON that were not included in the initial estimate. It does not reflect further unauthorized transfers." The distinction matters and should be read in full: the perimeter counted grew by some 36 million, the attack did not. Confirmed assets are XRP, ETH, USDT, ZEC, USDC, USDT0, XAUt (Tether Gold), BNB, AVAX and TRX, across Ethereum and several EVM networks, the XRP Ledger, Zcash and TRON. It remains true that the 387.5 million is the company's own count, which the company itself says may be updated, and that no third party has certified it.
WHAT WE VERIFIED OURSELVES. In the same announcement Bitget did something it was not obliged to do: it published the four primary receiving addresses. We queried them directly on their respective chains on 26 September, and they are practically empty. The EVM address 0x770b10b273fC44Fe9197D6bF20F145c2e98463Ee holds 0.008793 ETH at block 26,063,794 (identical to what we measured on the 25th: nothing moves through it any more). The XRP address rwNhefsz1UQEusxhCvHip3RANinWi4CTck holds 3.09 XRP at validated ledger 107,254,966, against the roughly 102.9 million XRP the press attributes to the theft. The TRON address TBWNguTTgezw9dVorX441C6nDrZpRxYwKD holds 0.4 TRX and zero USDT-TRC20. On the fourth, the Zcash address t1WgMdtND8NF7NDUuYmq8MpMj1NTCXkMDVG, we could not obtain a balance from an open public source, so we say nothing about it. The reading of the first three is clear enough: the funds are not parked where they arrived, they have already moved. That is the data point that supports the "ongoing" label better than any headline.
THE BOUNTY. On 25 September Bitget opened a recovery bounty programme: 5% of funds a third party helps to freeze and 5% of funds it helps to recover, up to a theoretical maximum of 10%. Actions carried out under a court order or at the request of law enforcement are excluded, and Bitget decides who qualifies, how each contribution is measured and how much to pay. Read it for what it is: not a guarantee of recovery, but a signal that recovery depends on third parties.
THE BOUNTY'S FIRST CONCRETE RESULT, AND WHAT IT IS WORTH. On 25 September at 05:00 UTC Circle blacklisted an address labelled "Bitget Exploiter 8", using the freeze function written into the USDC contract: 99,990 USDC. Tether did the same roughly seven hours later, through its own multisig: 218,023 USDT. About $318,000 frozen in total — which against 387.5 million is 0.08%, less than a tenth of a percentage point. The reason is structural and applies to any theft of this kind: an issuer can freeze only its own token, and the attacker had already converted the rest into ETH, which nobody can block. In that same wallet, according to on-chain trackers, roughly 170 ETH remains out of reach, and other linked addresses hold more than 63,000 ETH. On 26 September at 11:44 UTC the CEO publicly thanked Circle and Tether and raised the pressure on the part of the chain that did not cooperate: she formally asked THORChain, the cross-chain swap protocol, to "refuse service to these addresses", writing that "decentralization is a design principle, not a shield for facilitating known stolen funds". The precedent she cites carries weight: after the $1.46B Bybit theft, on-chain analyses say roughly $1.2B moved through that route. It is a real-time demonstration of what the bounty already implied — recovery does not depend on the victim, it depends on whoever stands between the attacker and the cash-out, and not everyone cooperates. A note on method: none of the sources published the frozen address in full, so we could not verify the freeze on-chain ourselves and the figures are as reported. What we did re-verify ourselves on 26 September is the EVM address Bitget published: 0.008793 ETH at block 26,064,276, identical to the two previous measurements — nothing is moving through it.
THORCHAIN'S ANSWER HAS ARRIVED, AND IT IS A REFUSAL. On 26 September at 18:17 UTC — six hours after the request — the protocol replied publicly from its official account and pinned the message to the top of its profile, which makes it a stated position rather than a passing comment: "We are devasted to hear about the recent exploit and can imagine how difficult this must be for everyone involved. THORChain is decentralized and permissionless like Bitcoin, Ethereum, and BNB Chain. What responsibility should Bitcoin, Ethereum, and BNB Chain bear when handling known stolen funds?" No block, no commitment: the request is turned down with an analogy, and the message names both Bitget's CEO and OKX's founder, who had himself challenged the decentralisation claim. The sequence is worth reading in full, because it is the most useful thing this incident teaches anyone holding money on an exchange: the stablecoin issuers froze within hours, but could only touch 0.08% of the total; the part of the chain that could have touched the rest answered within six hours that it is not its business. What a genuinely permissionless protocol can technically do remains an open debate; what it answered is a fact. Meanwhile trackers indicate the attackers are using not only THORChain but also Chainflip, Uniswap, 1inch Fusion, Stargate, Across and Relay: the laundering is running along several routes at once.
WITHDRAWALS: THERE IS A DATE, AND IT IS NOT TODAY. On 26 September at 03:57 UTC Bitget published the phased reopening schedule, stating that "the temporary withdrawal pause remains a security measure and is not related to the availability of user assets": BTC on the Bitcoin network from 28 September at 08:00 UTC; ETH on Ethereum, BSC, Arbitrum, Base and Optimism from 29 September at 08:00 UTC; USDT on Ethereum, BSC, Solana and TRON from 30 September at 08:00 UTC; everything else — other tokens, fiat and P2P — from 2 October at 08:00 UTC. Until then the exit stays shut: an announced schedule is not an executed withdrawal, and this card will record it as reopened only when withdrawals actually work.
THE COVERAGE, WITH A DETAIL THAT CHANGES WHAT THE FIGURE MEANS. On 25 September at 03:10 UTC Bitget spelled out the composition of the protection fund: it "holds 5,500 BTC, approximately $464M at current prices", with the addresses declared public and verifiable on-chain by anyone (in the announcement, however, the addresses are not listed and no third party has yet published that verification). The detail that matters is that the fund is denominated in bitcoin, not in dollars: the declared capacity covers the 387.5 million loss about 1.2 times, but that is a ratio that moves with the price of bitcoin — if BTC falls by a fifth, the margin is gone, and through nobody's fault. The company adds that "losses from this hot wallet incident after assessment will be borne by the Protection Fund" and that the fund will be replenished, but that "details and coverage terms will be announced separately": as of this verification, those terms have not been published.
ON THE PERPETRATOR. The company said that IP address patterns — traced to VPN services previously used by a North Korean group — and on-chain signatures are consistent with techniques of groups linked to North Korea, specifying itself that the attribution is not confirmed; investigators point to the Lazarus group. Since 25 September a voice other than the victim's has been added: on-chain analytics firm Elliptic considers North Korean origin "very likely" and calculates that with this theft the haul of groups linked to Pyongyang in 2026 passes one billion dollars. It remains an assessment by a private party, not a finding by an authority, and it is written that way here.
ONE THING THAT IS NOT TRUE, AND WORTH KNOWING. Bitget Wallet, the self-custody wallet, runs on infrastructure completely separate from the exchange and was not involved: the company states this in three separate communications. Headlines about a "Bitget Wallet breach" confuse the exchange's on-chain wallets with the product called Bitget Wallet: they are two different things, and in the second the keys sit on the user's device.
THE MOST IMPORTANT OPEN POINT, AND THE DATE IT HAS JUST BEEN GIVEN. The full technical report the company had promised "within 24 hours" of the first notice never came out: three days on, what has been published are progressive updates — useful, detailed, but not a post-mortem. Still missing is the answer to the question that weighs on any judgement of the company: how was that backend system compromised?
On 27 September at 11:00 UTC Bitget announced when it will arrive: an «Incident Report for Users» livestream on 28 September at 07:30 UTC on Bitget X Live and Bitget Live, with chief executive Gracy Chen and Xie Jiayin, to «discuss the incident report, answer questions, and share the latest updates on withdrawals». Two things should be read together, and neither is a detail. First: after three days the report finally has a date. Second: the announced format is a live question-and-answer session, not a written document — and a livestream cannot be quoted, checked line by line, or left on the record the way a post-mortem can. Until a text is published, the point stays open even after the 28th.
Then there is where it sits in the calendar: 07:30 UTC on 28 September falls thirty minutes before the 08:00 UTC at which, under the company's own plan, the first withdrawal tranche (BTC) is due to reopen. The livestream therefore lands just before the moment the promise becomes checkable by users. This page will record the reopening only when withdrawals are actually going through, not when they are announced on air.
28 SEPTEMBER, THE FIRST THING ACTUALLY CHECKABLE: BTC WITHDRAWALS RESTARTED. At 08:00 UTC on 28 September the first tranche reopened as announced, and at 08:34 UTC Bitget confirmed it on its official account: the resumption «follows additional security work across Bitget's withdrawal infrastructure», the vulnerability «has been remediated», the incident «remains contained, with no further unauthorized transfers identified following containment», user balances are unaffected. The Block, BleepingComputer, crypto.news, Crypto Times and U.Today reported it the same day. According to figures released by the company and picked up by the press, at 09:00 UTC — one hour after the opening — 9,585 BTC withdrawals had been processed across the Bitcoin and BSC networks, totalling about 4,098 BTC, with a declared reserve ratio of 127%. It is the company's own count, certified by no third party; but the order of magnitude says the queue was cleared, not that a single demonstration withdrawal went through. The rest of the schedule is confirmed: ETH on the 29th, USDT on the 30th, everything else — fiat and P2P included — on 2 October, all at 08:00 UTC. Until then the exit stays shut for anything that is not BTC, which is why this entry is still marked "ongoing".
THE LIVESTREAM HAPPENED, AND IT MOVED PART OF THE STORY: THE FLAW WAS NOT IN-HOUSE. At 07:30 UTC Gracy Chen and Xie Jiayin held the announced livestream; the recording, one hour and thirty-two minutes, is published on the exchange's official account as «Incident Recap». The explanation given is more precise than that of the previous days and moves the point of entry: the attacker exploited «a vulnerability in a third-party security product» used by Bitget to obtain high-level internal credentials, and used them to send forged withdrawal commands to the wallet system, making it execute abnormal transfers that bypassed risk controls. Private keys were not compromised, cold wallets were not touched. The clarification has to be read in both directions at once, because they pull opposite ways: it was not Bitget's own code that gave way first — but it was a security tool chosen, bought and deployed by Bitget that became the way in, which is a question of how a supplier is picked and watched, not a stroke of bad luck. The company said it will review how it assesses and deploys third-party security products. The supplier was not named.
THE FUND'S NUMBERS, STATED ON AIR. Chen put the User Protection Fund at more than 464 million dollars at the time of the suspension — about 5,500 BTC, according to The Block's and BleepingComputer's account —, put platform holdings at over 1.4 billion dollars, and committed to bringing the fund back to its 300 million dollar baseline within a week. These are figures stated by the company on a livestream, not audited accounts nor a proof-of-reserves attestation: they are the promise the loss coverage rests on, and the proof will be the next attestation, not the announcement.
THE WRITTEN REPORT IS STILL MISSING. What this page said before the livestream still holds: a livestream is not a post-mortem — it cannot be quoted line by line, checked, or left on the record. The company now states that the internal security report will be completed «this week»: it is the third deadline given to the same document, after the «24 hours» promised on 24 September and the 28 September livestream. Until a public text exists, how that third-party product was compromised remains an unanswered question, and with it any judgement on how avoidable this was.
ON THE HUNT FOR THE FUNDS, AN UPDATE THAT IS NOT A RECOVERY. On 28 September independent investigator ZachXBT wrote that Chinese actors are laundering the exploit's funds on behalf of the «alleged DPRK attackers», openly asking for support with their orders in public Discord servers and Telegram channels of the services they use. It is an indication of who is moving the money, not a recovery: nothing has come back, and the North Korea attribution remains an assessment by private parties, not a finding by an authority.
29 SEPTEMBER, SECOND TRANCHE MET: ETH WITHDRAWALS ARE BACK TOO. At 08:00 UTC on 29 September ETH withdrawals reopened, as scheduled. Bitget confirmed it on its official account with its own figures: at 09:00 UTC, one hour after opening, about 9,674 ETH had come in and about 9,023 had gone out — more deposits than withdrawals, a net inflow of about 651 ETH. In the same message the company also confirmed that the previous day's reopening covered BTC on the Bitcoin and BSC networks. These are the company's figures, not checked by third parties; what they say with certainty is only that the second tranche too opened at the promised hour. Still to come: USDT on 30 September and everything else — fiat and P2P included — on 2 October.
TWO MORE DETAILS ON THE HOW, FROM THE CEO. In the livestream, in an interview with The Block and in comments to Cointelegraph (reported by The Hacker News on 28 September), Gracy Chen described the flaw in the third-party product as a zero-day, meaning a vulnerability not yet known to or fixed by its maker at the time of the attack. She also laid out the sequence: at 18:31 UTC on 24 September the attacker made two small test transfers that stayed below the risk-control threshold and so triggered no alert; the large transfers started about thirty minutes later. It is a detail that matters: it means that for half an hour the system saw anomalous movements and let them through because they were small. The maker of the compromised product remains unnamed, and the written report has still not come out: for the evening of the 29th the company announced a second livestream with the CEO, not a document.
THE EVENING OF 29 SEPTEMBER: THE PROTECTION FUND HAS HALVED, AND CUSTOMERS LEFT IN NUMBERS. This is the most important development since withdrawals reopened, and it did not come from the exchange. On 29 September Bloomberg measured roughly 463 million dollars of net outflows in the 24 hours to Tuesday: the largest single-day net outflow since DefiLlama began tracking exchange proof-of-reserves four years ago. Against remaining reserves of about 5.7 billion dollars, that is more than 10% in one day. Above all: the three addresses Bitget itself identifies as its protection fund, worth about 464 million dollars (5,500 BTC) on 25 September, have fallen BELOW 200 million according to Bloomberg's on-chain reading. Here is the comparison that matters: the fund underpinning the whole "the loss is covered" reassurance is now worth less than half the declared loss (387.5 million). Gracy Chen confirmed it to Bloomberg in her own words: "The Protection Fund is being used to absorb the financial impact of the incident. Bitget will replenish the Fund using its own capital, with the Fund targeted to be above 300 million dollars within one week." That is a dated promise, and therefore a checkable one: the addresses are public and anyone can look at them in a week's time. Until the balance climbs back, it stays a promise.
THE 29 SEPTEMBER PROOF OF RESERVES, READ BY US ON THE OFFICIAL PAGE. The same day the company published a new proof-of-reserves attestation and announced it on its official account with an overall ratio of 131% across 19 assets, all above 100%. We went and read the page: snapshot of 29 September 2026 at 11:00 UTC+8 (03:00 UTC), Merkle root 15893cf0dae1c552. The per-asset ratios say more than the total: BTC 142%, USDC 154%, NEAR 181%, USDGO 169%, LINK 137%, LTC 131% — but ETH 110% and USDT 107%. The thinnest margins sit on exactly the two most-used assets, and USDT is the one reopening on 30 September. Two necessary caveats. First, the snapshot is from 03:00 UTC on the 29th: it predates the reopening of ETH withdrawals (08:00 UTC) and predates the 463-million outflow day, so it does not capture either. Second, a reserve ratio above 100% says the platform's holdings covered user balances at the moment of the snapshot; it does not say the loss has been made good. The loss is covered by the fund, and it is the fund that has halved. For reference, the previous attestation (issue 46, snapshot of 17 September, before the incident) showed 135%. The CEO commented: "We have never touched customer funds — which is why, even after this incident, our reserve ratio remains above 131%."
A THIRD LIVESTREAM IN SIX DAYS, AND STILL NO DOCUMENT. The second livestream announced for the evening of the 29th did take place (the replay is on the official account). That makes three broadcasts since 25 September. The written report — promised "within 24 hours" on the 24th, then pushed to the 28 September livestream, then to "within this week" — still did not exist as of the evening of the 29th. One detail on figures that look contradictory and are not: Bitget reports a net POSITIVE balance on ETH in the first hour after reopening (about 9,674 in against 9,023 out at 09:00 UTC), while DefiLlama counts 463 million in net outflows. The first is one asset in one hour, measured by the company; the second is the whole platform over 24 hours, measured from outside. Choosing which one to quote is also choosing what to show.
30 SEPTEMBER: THE THIRD TRANCHE REOPENED, AND IT IS THE ONE THAT MATTERS MOST. At 08:00 UTC on 30 September USDT withdrawals restarted on Ethereum, BNB Smart Chain, Solana and Tron, as per the schedule the company published on 24 September (official support page, updated on the 24th at 23:30 UTC). The reopening was confirmed the same day by crypto.news and Crypto Times. It is the third tranche out of four met at the announced date and time, after BTC on the 28th and ETH on the 29th, and it is the most significant of the three: USDT is the asset with the thinnest reserve ratio in the 29 September attestation (107%) and the one holding most of the frozen balances. The last tranche is still shut — all other tokens, fiat and P2P — announced for 2 October at 08:00 UTC: until it opens, this entry stays marked «ongoing». CEO Gracy Chen said that «the business is gradually back to usual».
THE PROTECTION FUND IS BACK UP: 309 MILLION, READ BY US ON THE OFFICIAL PAGE. On 28 September the company committed to bringing the fund «to more than 300 million dollars with company capital within the week». On 30 September the CEO posted a screenshot of the fund's public page showing a balance of 309 million dollars, or 3,705 BTC. We did not stop at the screenshot: we went and read the official fund page (bitget.com/promotion/protection-fund) at 11:30 UTC on 30 September and it states exactly «The fund is currently valued at $309M», 3,705 BTC. The dated commitment was therefore met, in two days rather than a week. Three caveats remain, and they change what the number means. First: that page is the company's own, and it values the fund at the bitcoin entry price set at 00:00 UTC each day — it is a more direct reading than a screenshot, not an on-chain verification by us, and the dollar balance moves with the BTC price. Second: 309 million is still below the 387.5 million declared loss, and below the 464 million (5,500 BTC) the fund was worth before the incident. Third: the top-up was made with company capital, not with funds recovered from the attacker — we checked the receiving addresses ourselves on the 26th and they are empty. Covering the loss therefore still depends on the company's balance sheet, and the terms under which an individual user can claim against the fund have still not been published.
SIX DAYS, THREE LIVESTREAMS, NO DOCUMENT. The written report on the incident — promised «within 24 hours» on 24 September, then postponed to the 28 September livestream, then to «within this week» — had still not been published on the morning of 30 September, and the company kept announcing it without giving a date. The findings of the two independent investigations, however, landed the same day: the paragraph below records them.
30 SEPTEMBER, AFTERNOON: THE TWO INDEPENDENT INVESTIGATIONS HAVE REPORTED, AND THEY PUSH THE START OF THE ATTACK BACK TO 31 AUGUST. This is the first third-party document on the incident, after six days of livestreams only. Bitget published the interim findings of the two firms it appointed — Mandiant (Google Cloud's cyber-defence arm) and SlowMist — and folded them into its own official incident page, updated on 30 September; the news was picked up the same day by BleepingComputer, The Hacker News and Crypto Times. What they say: the attacker got in by compromising TWO third-party security products in use at the exchange, in at least one case through a zero-day; deployed a web shell on one of the appliances and opened a command-and-control channel; from there moved laterally to the production server that runs wallet jobs, where it installed malicious packages and ran a custom-built withdrawal tool that forged the risk-control parameters and then invoked the wallet's normal withdrawal process. Private keys not compromised, cold wallets untouched. In substance it confirms what the company said on the livestream of the 28th; the difference is that two third parties now say it under their own names, with a timeline.
THE NEW FACT, AND IT MATTERS: THE ATTACKER HAD BEEN INSIDE FOR TWENTY-FIVE DAYS. The earliest malicious activity found in the available logs dates to 31 August 2026: a service running on one of the two appliances — SlowMist calls it «Product A» — hit by the zero-day, a hidden script started under that service's process, and a connection to the database. Further activity matching the same pattern appears between 23 and 25 September. That means almost four weeks passed between first access and the money moving, and nothing rang. The exchange noticed the intrusion only once funds started leaving: the reconciliation system flagged the first discrepancies at 19:05 UTC on 24 September, thirty-four minutes after the two test transfers that stayed below the alert thresholds. At 21:44 UTC Bitget halted its signing machines and isolated the withdrawal service; the root cause was identified at 08:43 UTC on the 25th. The theft window itself lasted about two hours and fifty-two minutes, with one wave of roughly 185 million dollars moved in little more than a minute around 19:16 UTC (Crypto Times reconstruction from SlowMist data).
THE HOLE THAT STAYS OPEN, AND IT IS NOT BITGET'S. Neither SlowMist nor Mandiant names the vendor or the products: SlowMist calls them «Product A» and «Product B». There is no public CVE, no vendor advisory, no list of affected versions. The consequence concerns anyone keeping money on a platform, not just on this one: any other exchange or custodian running the same appliance cannot patch a flaw whose name and version it does not know. This is not a procedural detail — it is the difference between a closed incident and a vector still open across the rest of the industry.
THE DISTINCTION WORTH KEEPING, BECAUSE IT IS EASY TO LOSE. What came out on 30 September are the conclusions of two outside firms, which both describe them as INTERIM and still ongoing. It is not Bitget's own internal report, which still does not exist: the company announced it for the fourth time, «within this week», in a message from its official account on 28 September — the same one in which it published the attacker addresses and tracing data, and in which it writes that «the September 24 incident is the first security incident of this nature affecting Bitget Exchange in eight years of operation». The two do not substitute for each other: the investigations say how the attacker got in, the company's report should say why that appliance was exposed and what changes from tomorrow. The first question has an answer, the second does not.
WHERE WITHDRAWALS AND THE FUND STAND ON THE EVENING OF 30 SEPTEMBER. During the afternoon the CEO summed up on her own account: protection fund brought back «above 300 million as promised» (309 million on the official page, which we read at 11:30 UTC), reserve ratio at 131% per the 29 September attestation, withdrawals «already resumed for BTC, ETH and USDT» and everything else «on Friday» — which is 2 October, the same date as the official schedule. The exchange's account confirmed the fund's top-up above 300 million the same day. Three tranches out of four met; the fourth, which covers fiat and P2P, is the only thing users cannot yet verify for themselves, and that is why this entry stays marked «ongoing».
HOW MUCH HAS BEEN RECOVERED: 0.22%. According to the reconstruction published on 30 September by rekt.news, the total publicly frozen is about 842,000 dollars — roughly 339,000 in stablecoins between Circle and Tether and about 503,000 stopped mid-execution by the NEAR Intents service — out of a 387.5 million loss: 0.22%. These are reported figures we could not verify on-chain ourselves (no source has published the frozen addresses in full); what we did verify, on 26 September, are the destination addresses published by Bitget, and they are empty. The CEO herself said she is not «very optimistic» about recovery, citing the Bybit precedent: a year after that theft about 3.5% had come back. It works as a realistic measure of what protects a balance on an exchange after an attack of this kind: not the hunt for the funds, but the company's balance sheet.
THE CONTEXT, AND IT IS NOT COLOUR. On 30 September CertiK closed the month's books: September 2026 is the worst month of the year, about 766.4 million dollars lost to exploits and phishing and the highest incident count recorded in 2026. Two cases alone — Bitget's 387.5 million and the 318.7 million taken from Blockstream's Liquid Network on 6 September — account for more than 92% of the month's confirmed losses. On attribution nothing changes: the CEO keeps pointing to North Korea on the basis of IP address patterns and on-chain analysis, and TRM Labs reports overlaps between the laundering network and wallets used in earlier Pyongyang-linked attacks, but states that it has NOT definitively attributed the intrusion. These remain assessments by private firms, not findings by any authority.
2 OCTOBER: THE ANNOUNCED HOUR PASSES IN SILENCE. The fourth and final withdrawal tranche — other tokens, fiat and P2P — was set by the company for 2 October at 08:00 UTC. At 17:30 UTC the same day, twelve hours later, there is no confirmation that it happened, and we checked the primary sources one by one. The official incident page, the source for this entry, is still dated 30 September and still says, in the future tense, that those withdrawals are «scheduled to resume on 2 October at 08:00 UTC». The exchange's account posted four times in the hours after that time — the bitcoin price, the rewards programme launched after the attack, an institutional event, a USDC yield offer — without ever saying the exit was open. The support account has not posted since 2023. One outlet wrote that the company «completed the restoration of withdrawals» on 2 October, but without specifying which assets and in contradiction with the company's own page: that is not enough, and writing «reopened» on the strength of an announced hour would be writing a fact nobody has established. That is the difference between the first three tranches and the fourth: BTC on the 28th, ETH on the 29th and USDT on the 30th were announced and then observed at the stated date and hour, each with its own press coverage. Not this one. So the entry stays marked «ongoing» and the recommendation still says to try a small amount first.
THE FROZEN TOTAL NOW HAS A FIGURE, AND IT IS STILL CRUMBS: 1.1 MILLION OUT OF 387.5. On 2 October CEO Gracy Chen spoke to CNBC. She said the company has frozen about 1.1 million dollars of the nearly 388 million stolen: 0.28%. It is the first figure on the frozen amount attributable to the company — until yesterday the public number was about 842,000 dollars, 0.22%, and it came from a rekt.news reconstruction, not from Bitget. On recovery she repeated that she is not optimistic and explained why using the precedent she knows best: Bybit, after the 1.5 billion dollar ether theft of February 2025, had a year later frozen and recovered some 80 million in all, 3.5% of what it lost. ⚠️ The CNBC article does not open from Europe (403 both to fetch and in the browser): we verified the statements on two outlets that cite the interview and do open, in agreement on the frozen figure, on the CEO's words and on the protection fund above 300 million rebuilt with company capital. The practical measure for anyone with money in there does not change, it sharpens: what protects a balance after an attack of this size is not the hunt for the funds, it is the balance sheet of whoever runs the exchange.
3 OCTOBER, MORE THAN EIGHTEEN HOURS ON: THE SILENCE HAS BECOME THE FACT. We re-read the same sources at 02:30 UTC on 3 October. The official incident page is still dated 30 September and still says, in the future tense, that other tokens, fiat and P2P are «scheduled to resume» on 2 October at 08:00 UTC: it has not been touched. The exchange's account, after the four posts in the hours following the announced time, stopped posting around the middle of the afternoon on the 2nd and has never mentioned withdrawals. In eighteen hours no outlet writes that the fourth tranche is open: they all still report the date as a schedule. So it is no longer merely «the announced hour was not confirmed»: more than eighteen hours on, with the official page untouched, the silence is itself the verified fact. It does not mean withdrawals are certainly still blocked; it means the only way to find out is to try, and that anyone holding funds there has no statement to rely on. That is why «ongoing» and «unresolved» stay.
3 OCTOBER AT MIDDAY, PAST THE TWENTY-FOUR-HOUR MARK: THE ACCOUNT SPEAKS AGAIN, BUT NOT ABOUT WITHDRAWALS. Third re-reading of the same page, at 11:45 UTC on 3 October: unchanged. Still «Updated: September 30, 2026», and in the section answering «Have Bitget withdrawals resumed?» only BTC and ETH are named as open, while USDT from 30 September and the whole 2 October tranche remain in the «scheduled to resume» column. We are more than twenty-seven hours past the announced time, and therefore past the twenty-four hours we had set as the limit for treating this silence as a delay. What has changed since the reading nine hours earlier is the exchange's account: it is no longer quiet. It has started posting again — an institutional event announced for 5 October and a programme with yields advertised up to 12% on stablecoins — and neither post mentions withdrawals. That does not prove the exit is closed, but it removes the only excuse the silence had: this is not a company that stopped communicating, it is a company communicating something else. In twenty-seven hours no outlet writes that the fourth tranche is open: they all still report the date as a schedule. «Ongoing» and «unresolved» stay, and that is why.
WHO FROZE THAT MONEY: NOT BITGET. There is one more detail on the 1.1 million frozen that changes what the figure means. According to The Hacker News, on 1 October, the roughly 1.1 million dollars were frozen by Circle, Tether and NEAR Intents — that is, by the stablecoin issuers and by a third-party service the laundering passed through, not by the exchange and not by an authority. It is the practical confirmation of what the CEO says in words: after an attack of this size, what gets recovered is not recovered by the victim, it is frozen by whoever has the technical power to freeze a centralised token. Anything that leaves in bitcoin, in ether or on a network with no issuer has nobody who can stop it.
4 OCTOBER: THE FOURTH TRANCHE IS SHOWN AS OPEN, AND IT IS THE COMPANY SAYING SO. At 12:10 UTC on 4 October we re-opened the primary sources in the browser (on those pages a command-line fetch returns only the JavaScript shell). The explainer page dated «30 September» is still there, unchanged, and still puts the last tranche in the future tense: stop at that one and the silence looks like it is still running. But the company keeps a second page, dedicated to the incident and continuously updated, which reads «Last updated: 2026-10-04 00:00 UTC» and says the opposite in two separate places. In the timeline of confirmed facts the «2026-10-02 · 08:00 UTC» entry is in the past tense: «withdrawals for other cryptocurrencies, fiat currencies and P2P have gradually resumed». And in the resumption status table all four tranches — BTC on the 28th, ETH on the 29th, USDT on the 30th, and other tokens, fiat and P2P on 2 October — are marked «Resumed». The question left open for two days closes here, and it closes on a first-tier source: the company states it, on its own page, with a date. Two things need saying about how it closed. First: the confirmation came as a silent page update, not as an announcement — BTC, ETH and USDT each got a dedicated notice, the fourth tranche did not, the exchange's account has never mentioned it, and to date no outlet reports the exit as open: all of them still report 2 October as a schedule. Second: the word the company chose is «gradually». The reopening is therefore a declared fact, not a switch, and anyone holding a thinly traded token may still find the exit shut. One signal not to misread, because it is easy to: the support centre is currently publishing suspension and resumption notices on individual tokens (PARTI on Base, ATOM, STX, PONS, LAB, SKYAI, 0X0, and a fresh suspension of GMT on Solana on 4 October), but all of them give «wallet maintenance» as the reason and come in suspend-then-resume pairs: that is the ordinary traffic of any exchange, not the tail of the post-attack reopening, and counting it as such would be wrong in both directions.
WHAT THE SAME PAGE UPDATES, AND WHAT IS STILL MISSING. The protection fund is stated at over 314 million dollars, 3,705 BTC, with a total reserve ratio of 127%: more than the 309 million we read on 30 September, still below the 387.5 million declared loss and far from the 464 million it held before the attack — and still company capital, not recovered funds. The 388 million figure is now presented as «final verified», across 12 hot and warm wallet addresses. The written technical report — promised «within 24 hours» on 24 September, then pushed from livestream to livestream — is still billed as «coming soon»: ten days, four broadcasts, no company document. Hence what changes on this entry: «ongoing» switches off, because the withdrawal freeze was the last thing still happening to users and the company states it is over; «unresolved» stays, and stays for the 387.5 million never recovered, for the report that does not exist, and for a loss coverage that is so far a statement.
What to do
The exit from Bitget is shown as open across all four tranches: BTC since 28 September, ETH since the 29th, USDT since the 30th and, from 2 October at 08:00 UTC, other tokens, fiat and P2P as well. We read the confirmation of that last tranche ourselves at 12:10 UTC on 4 October on the official incident page, updated at midnight UTC the same day; no outlet reports it and the company's own word is «gradually». So treat it as a statement to verify on your own account, not as a certainty: if you want to cut your exposure, make a small test withdrawal first and move the rest only once it has landed at your address, and if the withdrawal does not go through, keep the screenshot — that is the evidence a complaint needs. If you hold a thinly traded token, check the support centre's notices for your asset too: individual tokens are being suspended and reopened for wallet maintenance these days, independently of the attack. USDT is the asset with the thinnest reserve margin in the latest attestation (107%): if you need to move it, do not put it off. Write your balance down now — amount per asset, date and time, dated screenshots of the account and of any rejected withdrawal — because you will need it to file a complaint or to claim against the protection fund, whose terms for an individual user have still not been published. Before putting more money in, look at where the fund actually stands: on 4 October the official page states over 314 million dollars (3,705 BTC, 127% reserve ratio), against a declared loss of 387.5 million and the 464 million the fund held before the attack, and the top-up is company capital, not recovered money. So «the loss is covered» remains a company statement, and that page is one you can check yourself. Do not count on recovery: we verified the destination addresses ourselves and they are empty, the frozen amount is about 1.1 million dollars out of 387.5 — 0.28% — a figure the CEO gave CNBC on 2 October, and that little was frozen by Circle, Tether and NEAR Intents, not by Bitget; the CEO herself says she is not optimistic. If you use Bitget's APIs for bots or third-party services, rotate or revoke your keys: the intrusion ran for twenty-five days before it was spotted, and an old application credential is the simplest thing to rebuild from scratch. Follow updates only through official channels: in the weeks around a reopening, fake «refund forms», impersonated support accounts and self-styled paid fund-recovery services multiply — the only bounty programme is Bitget's own, aimed at third parties who help freeze funds, nobody will contact you to give you your money back, and nobody, under any circumstances, needs your password, your 2FA code or your seed phrase to refund you or to «unblock» a withdrawal: anyone asking for them is robbing you a second time. If you use Bitget Wallet, the self-custody wallet: the company states it runs on separate infrastructure and was not involved, so you have nothing to move because of this incident — and for that very reason, distrust anyone telling you otherwise and asking you to «secure» your seed phrase.
Source: bitget.com ↗
verified on October 4, 2026
See the profile →
Mediobanca Premier — Conto Premier
Welcome bonus
Banca Mediolanum — SelfyConto
Welcome bonus
Wirex Card EEA
Referral bonus
Gemini Exchange
Referral bonus
Tria Card
Crypto neobank · rating 4.1 · tier A