Bitget paused withdrawals after unauthorized wallet transfers detected at 18:31 UTC on September 24. Its initial estimate was $351.6 million; on September 25 it revised the affected assets to approximately $387.5 million. The exchange later published a phased withdrawal schedule and an update on independent investigations. Its protection-fund and containment assurances are company statements, not our independent verification of repayment. [1] [5]
Follow-up: the backend explanation and later findings
On September 25, CEO Gracy Chen said the attacker had compromised a critical backend system within Bitget’s wallet infrastructure, manipulated transaction data and caused the authorization process to move funds out. She said private-key compromise had been excluded and the incident contained, while the initial intrusion method was still under investigation at that stage. This explained how transfers were authorized; it did not yet establish how the attacker first entered the system. [4]
Bitget’s later accounting put the affected assets at approximately $387.5 million, adding Zcash and TRON transfers omitted from the initial estimate. The company said the higher number represented a fuller accounting of the original incident, not additional unauthorized transfers. Its September 30 update said Mandiant and SlowMist had independently investigated and identified compromised third-party security products that enabled unauthorized access to the wallet environment. That is Bitget’s summary of the investigations, rather than a technical finding independently reproduced here. [5] [7]
On September 26, Bitget announced planned withdrawal resumption at 08:00 UTC on September 28 for BTC, September 29 for ETH, September 30 for USDT and October 2 for other tokens, fiat and P2P. The announcement says availability is shown in the platform. A published rollout schedule does not independently prove that every asset or customer can withdraw now: check the genuine app or current official notice for your specific network. No unsolicited support contact can bypass that availability check. [6]
A balance is not the same as access
For a customer trying to withdraw, the immediate problem is the difference between a number on an account screen and the ability to move those assets elsewhere. A protection-fund assurance does not itself complete a withdrawal. Nor does a platform-wide pause establish that an individual customer’s password or recovery phrase was stolen.
The original September 24 notice did not give a reopening time; the September 26 announcement subsequently supplied the dated rollout schedule above. Check present availability through the platform, rather than treating the first notice or a copied status message as current.
Verify the messenger before following the recovery instructions
An exchange incident can make an unsolicited “support” message seem timely. That is a reason to verify the sender, not evidence that a Bitget impersonation campaign has already been observed in this case. A message promising to bypass a platform restriction is asking you to trust a different person with your account or funds.
Open the Bitget app you already use or type the official website address yourself. Bitget’s verification guide explains how to check a webpage, email address or social account with its official channel tool and report an unrecognized result. Do not reach that checker through the suspicious message itself. [2]
The selector in Bitget’s example matters: checking an email address and checking a website are different searches. A familiar display name or copied logo is not the item being verified. Even a channel check is not permission to disclose a secret or approve a transaction you do not understand.
If you already answered a suspicious message
Bitget’s scam-response guidance says its staff will not request passwords, two-factor codes or private keys. If you disclosed account credentials, change the password through the genuine service, review Device Management, remove unfamiliar sessions and secure the linked email account. Contact support through the app or Help Center, keeping screenshots and transaction IDs. Recovery is not guaranteed. [3]
If someone instead supplied a destination and told you to move crypto there, stop and establish who controls it. Our guide to verifying a crypto wallet before sending money explains why an address that exists on a blockchain is not proof of a trustworthy recipient.
The distinction to keep is simple: investigate personal account activity through the genuine service, and follow the exchange’s own incident updates for withdrawal availability. A stranger offering a shortcut cannot establish either.
References
- Bitget. Security notice: hot-wallet incident. September 24, 2026; accessed September 25, 2026.
- Bitget. How to verify official channels and report suspicious links. July 29, 2025; accessed September 25, 2026.
- Bitget. Steps to take after falling victim to a scam. January 17, 2025; accessed September 25, 2026.
- Gracy Chen. Gracy Chen: preliminary wallet-backend findings. September 25, 2026; accessed October 6, 2026.
- Bitget. Latest incident update: revised accounting and recovery. September 25, 2026; accessed October 6, 2026.
- Bitget. Phased withdrawal resumption schedule. September 26, 2026; accessed October 6, 2026.
- Bitget. Update on SlowMist and Mandiant investigations. September 30, 2026; accessed October 6, 2026.
