On September 24, Bitget detected unauthorized transfers from some of its hot wallets and paused withdrawals while investigating. CEO Gracy Chen initially estimated the loss at $351.6 million, later raising it to $387.5 million, and said cold wallets were safe and the exchange’s $464 million-plus User Protection Fund would cover the losses. Chen said attackers compromised a backend wallet system and used fake transaction data to bypass transfer checks without stealing private keys. Bitget brought in Mandiant and SlowMist, notified law enforcement and launched a bounty to recover the funds.
On Monday, Bitget began a phased resumption of withdrawals, with Bitcoin withdrawals on the Bitcoin network reopening at 08:00 UTC on September 28. The exchange says the weakness has been fixed, no unauthorized transfers have been found since the attack was contained, and user balances are unaffected. Chen said the company will refill the Protection Fund to its $ 300 million baseline within a week.
Bitget has begun the phased resumption of withdrawals following the security incident identified on September 24, with BTC withdrawals on the Bitcoin network started at 08:00 UTC on September 28 as scheduled.
The resumption follows additional security work across Bitget’s withdrawal infrastructure.
The vulnerability has been remediated and the incident remains contained, with no further unauthorized transfers identified following containment. User account balances remain unaffected.
— Bitget (@bitget) September 28, 2026
An on-chain analyst posting as @ai_9684xtpa reported that 2,042.28 BTC, worth about $ 169 million, has moved from the fund’s roughly 5,500 BTC into hot wallets, while another 3,457.72 BTC remains on the chain. The analyst noted the transfers were made in advance and should not be read as actual user withdrawal volume.
Exchange reserves can determine how customers absorb a major hack
After an exchange hack, how the exchange handles the missing money and whether it has enough reserves or insurance to cover the loss without passing it on to customers matter the most. Speed matters too. A customer is in a very different position if the exchange can cover the loss and keep withdrawals open than if customers are told that part of their balance will be used to fill the gap.
Bitfinex hack showed the cost of not having enough protection available to absorb a major loss. After the exchange lost about 120,000 BTC in 2016, it reduced all customer balances by 36%, meaning users immediately shared the cost of the hack. Bitfinex then issued BFX tokens representing what customers were owed and bought those tokens back over the following months. The approach eventually allowed customers to recover their losses, but the initial decision meant users had to carry the financial shock themselves while the exchange worked to make them whole.
Binance handled its 2019 hack differently because it already had a protection mechanism in place. The exchange lost about $40 million, but customers did not lose their balances. Binance used its Secure Asset Fund for Users, or SAFU, created in 2018 and funded partly through trading fees. Because the reserve was available when the attack happened, Binance could absorb the loss without asking customers to take a haircut. The quick response also meant the hack did not turn into a prolonged withdrawal crisis, where customers might start questioning whether their remaining funds were safe.
WazirX faced a much harder situation in 2024 because the roughly $230 million stolen represented about 45% of the funds held on the platform. There was no large enough reserve that could absorb the entire loss without affecting the balance sheet. The exchange therefore proposed a recovery plan that effectively spread the shortfall among users. In this case, the reserve size relative to the loss mattered more than the headline size of the protection available. Even a sizable reserve is of limited help when the stolen amount represents a huge share of customer assets.
Bybit had the largest loss of the four, but its response shows why access to liquidity and speed can matter as much as the size of the reserve. After losing about $1.5 billion, the exchange did not make customers wait for the stolen assets to be recovered before restoring their balances. It raised about $1.23 billion through bridge loans, large deposits and over-the-counter purchases and covered the loss within two days. It also processed more than 350,000 withdrawal requests within 10 hours. That meant customers could continue accessing their money instead of having to wait while the exchange rebuilt its reserves.
Crypto exchanges rally around Bitget as users question locked funds
Binance said its security team is working with Bitget to share security intelligence, trace the stolen funds and help recover them. Binance co-CEO Richard Teng said the work is ongoing, while founder Changpeng Zhao said Binance and the BNB Chain ecosystem would help however they could, without giving details on what that support would involve.
Other exchanges also offered assistance. Bybit CEO Ben Zhou said his company was ready to help, after Bitget had sent 40,000 ETH to Bybit within hours of its 2025 hack. MEXC CEO Vugar Usi and CoinDCX co-founder Sumit Gupta also offered support. Blockzeit reported that Tether and Circle joined efforts to track and recover the stolen assets. Bitget CEO Gracy Chen responded to Zhou by saying, “We are all in this together.”
Users, however, were focused on a more immediate problem: access to their money. Boboo’s complaint shows the frustration caused by the withdrawal restrictions. The user said they had been unable to withdraw for five days and were forced to rely on friends for financial support. The angry response reflects how quickly a security measure can become a customer trust problem when people cannot access funds they depend on.
Elevate raised a different concern about the withdrawal limits. The user said Bitget allowed only $2,000 to be withdrawn while keeping the rest of the funds locked, and asked why the restriction applied to their remaining balance.
@bitget Why the rest of my funds didn’t allow me to withdraw? You guys only gave me $2k for withdrawal and lock the remaining funds… I want a clarification on this https://t.co/OkZ6K7gjfZ
— Elevate (@Elevate_02) September 28, 2026
The complaint points to the need for clearer communication from the exchange, especially when security controls affect customers who were not involved in the attack.
Azeon’s reaction offered a more positive view, welcoming the return of withdrawals after Bitget completed additional security work. He also suggested that some customers saw the restrictions as a temporary security measure rather than a permanent loss of access. Together, the reactions show that Bitget’s recovery is being judged on two fronts: whether it can recover the stolen funds and whether it can restore normal access for customers without compromising the additional security measures.
Enjoyed this? Bookmark DeFi Planet, explore related topics, and follow us on Twitter, LinkedIn, Facebook, Instagram, Threads and CoinMarketCap Community for seamless access to high-quality industry insights
Take control of your crypto portfolio with DEFI PLANET PRO, DeFi Planet’s suite of analytics.
