Bitget Reopened Bitcoin Withdrawals After a $387.5M Hack—Here’s What You Should Do Next

When an exchange freezes withdrawals, the stress is real. You start doing mental math, refreshing X, wondering if you’ll ever see your coins again. Bitget says it has resumed Bitcoin withdrawals after a breach that pushed an estimated $387.5M into attacker-controlled addresses, with ETH and USDT staged right behind it on a published schedule . Good news—but don’t let “withdrawals are back” trick you into acting fast and sloppy. The smartest move is calm, methodical, and a little paranoid (in a healthy way).

What likely happened at Bitget (and why “withdrawals restored” isn’t the finish line)

If you’re feeling that urge to exhale because Bitget resumed Bitcoin withdrawals, I get it. “Withdrawals are back” sounds like the crisis is over. It isn’t.

Based on Bitget’s public comments and third‑party reporting, this looks less like a random wallet leak and more like a backend wallet infrastructure breach: attackers reportedly got into a critical system tied to Bitget’s wallet operations and then spoofed transaction data in a way that triggered the exchange’s own authorization process.

That detail matters. When an attacker can make internal systems “approve” bad withdrawals, it’s not just about rotating a private key. It’s about rebuilding trust in the whole pipeline: request creation, transaction signing, approvals, monitoring, and every service that touches those steps.

The hot wallet vs warm wallet part (why it hit fast)

Bitget said its security systems flagged multiple unauthorized transfers and that funds were taken from hot and warm wallets.

Here’s the plain-English difference:

• Hot wallets are connected enough to move coins quickly (good for normal withdrawals, bad when something goes wrong).
• Warm wallets usually sit in the middle—less exposed than hot, still used operationally.

If attackers can push withdrawals out of both, the exchange has to assume the “easy money” layer (hot) and parts of the “buffer” layer (warm) were in play. That’s why exchanges hit the big red button and pause withdrawals platform-wide: it stops the bleeding while they figure out what’s compromised.

Why staged reopening is a signal, not a victory lap

Bitget didn’t flip withdrawals back on for everything at once. It published a staged schedule:

• BTC withdrawals resumed
• ETH withdrawals (Ethereum, BSC, Arbitrum, Base, Optimism) set to resume Sep 29, 8:00 UTC
• USDT withdrawals (Ethereum, BSC, Solana, Tron) set to resume Sep 30, 8:00 UTC
• Other tokens / Fiat / P2P starting Oct 2, 8:00 UTC

That staged rollout usually means one thing: blast-radius control.

They’re likely re-enabling withdrawals in layers while they:

1. validate new controls under real load,
2. watch for weird authorization behavior,
3. make sure monitoring catches anything that resembles the original exploit path.

Also worth noting: the amount tied to attacker-controlled addresses was later updated to $387.5M based on on-chain tracing and transaction classification.  That kind of number tends to come with second-order effects—delayed reconciliations, throttled limits, and sudden policy changes—even after withdrawals “resume.”

So treat “Bitget resumes Bitcoin withdrawals after hack” as a change in status, not a clean bill of health. Your goal now isn’t to panic-withdraw. It’s to move carefully, verify what’s actually live, and protect yourself if conditions shift again.

Your next 60 minutes: a no-panic checklist that protects you even if the story changes

When an exchange says “withdrawals resumed,” your job is to verify reality, then move carefully. Bitget itself described the pause as a security measure and published a staged withdrawal restoration schedule across assets and networks . That means conditions can still be uneven for a bit.

Step 1: Confirm what’s actually live (10 minutes)

1. Check official updates only (Bitget website announcements + verified social accounts). Ignore screenshots in replies. Ignore forwarded Telegram “alerts.”
2. Match your asset + network to the schedule. Bitget shared specific restart windows for ETH networks and USDT networks, not a blanket “everything is back” .
3. Check the withdrawal page for:

• network availability (e.g., Ethereum vs Arbitrum vs Base)
• fees/spread changes
• temporary limits or extra reviews

If the network you need isn’t listed as available, don’t force it. You’ll end up rushing into the next mistake.

Step 2: Do a “small withdrawal” test (10–20 minutes)

Before you move serious size, prove the pipe works.

• Send a small test amount to a wallet you control.
• Triple-check the address character by character (copy/paste isn’t magic; clipboard malware exists).
• If the exchange supports it, use address whitelisting and withdraw only to whitelisted addresses.

When the test lands, then move the rest in 1–2 chunks. Not 12 micro-transfers, not one giant “all-in” send.

Step 3: Capture evidence while everything is fresh (5 minutes)

This is boring until it saves you.

• Screenshot:
• balances (by asset)
• withdrawal history
• any failed withdrawal errors
• Save:
• TxIDs, destination addresses, timestamps
• the network used (people forget this part)

If there’s ever a dispute, this is your paper trail.

Step 4: Treat “support” like a threat actor (ongoing)

During incidents, scammers swarm. They impersonate staff, post fake “reopen” links, and send urgent DMs.

Hard rules:

• No support DMs. Ever.
• Don’t click “Bitget Support” links from replies.
• Don’t install “verification” apps.
• Don’t share screenshots that show your email, UID, balances, or withdrawal addresses.

If you need help, open a ticket from inside your logged-in account, using a bookmark you already trust.

Step 5: Lock down the account (15–20 minutes)

Even if you plan to withdraw and leave, secure the account first. A compromised account can still cause damage.

Do this in order:

1. Change your Bitget password (long, random, never reused).
2. Change your email password tied to Bitget (attackers love email takeovers).
3. Turn on app-based 2FA (authenticator app). Avoid SMS 2FA if you can.
4. Review API keys:

• delete anything you don’t recognize
• disable withdrawal permissions where possible

5. Check withdrawal address settings:

• remove any whitelist entries you didn’t create
• add your own whitelisted addresses if you’ll keep using the exchange

One last reminder: Bitget said trading and deposits continued during the incident, and it framed the withdrawal pause as a security measure . That’s helpful context, but it doesn’t replace your own hygiene in the first hour.

What Bitget is saying about user funds—and how to read it like an adult

After you’ve done your immediate hygiene, the next trap is emotional reading: taking a reassuring statement as a full guarantee.

Bitget’s public messaging hits three big claims:

• the withdrawal pause was a security measure
• user account balances remain unaffected
• Bitget’s Protection Fund covers the financial impact of the incident

All three can be true at the same time, and you can still face real-world friction.

“User account balances remain unaffected” (what it does mean)

This is a ledger statement. It’s Bitget saying your on-screen balances weren’t reduced as a direct result of the theft.

Practical takeaway:

• Your account may still show the same BTC/ETH/USDT amounts as before.
• You’re less likely to wake up to a sudden “0” that you didn’t authorize.

What it doesn’t guarantee (the part people skip)

A balance being intact isn’t the same as instant access.

Even if your funds are “there,” you can still run into:

• Timing risk: withdrawals can be paused or throttled again if the exchange sees new suspicious activity.
• Asset/network constraints: withdrawals can reopen in waves by coin and chain (Bitget itself published a staged restart schedule).
• Operational friction: higher fees, longer review times, smaller limits, or extra checks.

So read “unaffected” as “your account entry still exists,” not “you can move everything right now with zero delays.”

“Protection Fund covers the financial impact” (how to interpret it)

This is Bitget saying it has a backstop to absorb losses at the platform level, rather than pushing the hit onto users.

What to take from that:

• It’s a solvency/coverage signal, not an access promise.
• It doesn’t tell you how fast every asset and network returns to normal.
• It doesn’t tell you what the internal accounting path looks like if they later reverse, unwind, or reconcile certain flows.

If you want to be strict about it: coverage is about “can they afford it?” Access is about “can you withdraw cleanly on your chain today?” Those are different.

“North Korea-linked” attribution: context, not comfort

Bitget’s CEO attributed the incident to North Korean hackers, citing on-chain analysis and IP behavior patterns, and tied it to a breach of backend wallet infrastructure with transaction data spoofing.

Two grounded ways to read that:

• Useful context: it hints at a professional attacker with repeatable playbooks, which explains why exchanges may tighten controls hard.
• Not reassurance: attribution doesn’t restore funds by itself. It doesn’t change your personal risk profile inside the account.

Your job isn’t to debate who did it. Your job is to treat this like any major exchange security incident: assume the situation can evolve, and make decisions that still work if the timeline slips or withdrawal conditions change.

The recovery track: what the 5% bounty means, and what you should realistically expect

If you’re watching this like a scoreboard—“hack happened, withdrawals reopened, we’re good”—the recovery phase will disappoint you. Recovery is messy, slow, and full of half-wins.

Bitget said it updated its estimate to $387.5M transferred to attacker-controlled addresses based on on-chain tracing and transaction classification . It also announced a Recovery Bounty Program offering 5% bounties for helping recover or freeze funds .

What a “5% recovery bounty” really signals

This isn’t a charity move. It’s an incentive structure.

A 5% bounty usually means Bitget is trying to motivate:

• Centralized exchanges and OTC desks to flag and freeze deposits linked to the stolen funds
• On-chain investigators to trace hops quickly and hand off actionable intel
• Counterparties who might control chokepoints (custodians, bridge operators, stablecoin issuers) to act fast

If you’re a normal user, you’re not expected to “hunt” the attacker. You’re expected to protect your own account and make rational access plans.

Why freezing stolen crypto is hard (and gets harder by the hour)

Freezing works best when funds hit a place that can freeze—usually a centralized service with compliance controls.

Once attackers start moving money across:

• multiple chains
• bridges
• swaps into other assets
• peel chains (breaking big amounts into lots of smaller ones)

…the odds of a clean freeze drop. The trail doesn’t disappear, but response options narrow.

So don’t confuse “traceable” with “recoverable.” On-chain visibility helps investigators follow the money. It doesn’t magically pull it back.

What to expect from exchange incident response timelines

Bitget said it fixed the exploited vulnerability and shared a staged restart plan for withdrawals: ETH networks at a set time, USDT networks after that, then “other tokens / Fiat / P2P” later .

That staged approach usually pairs with a real operational checklist:

• Internal forensics (what got touched, what logs can be trusted, what needs rebuilding)
• Control validation (monitoring, approvals, signing flows)
• Coordination with outside parties (other exchanges, chain analytics, potentially law enforcement)

Your realistic plan should assume:

• access can be choppy again
• specific assets/networks may reopen and re-restrict
• support queues can lag when the whole platform is under scrutiny

If withdrawals are open for your asset today, great. Still act like the situation can change quickly—because in incidents like this, it often does.

How to reduce your exposure the next time (without pretending you’ll never use exchanges)

If there’s one practical lesson from any big exchange incident, it’s this: your risk isn’t just “will they get hacked?” It’s also “what happens to me when withdrawals get paused?”

You don’t need to swear off exchanges. You need a setup where an exchange outage is annoying, not life-changing.

The simple split that saves people

Treat an exchange account like a checking account, not your vault.

Keep on-exchange:

• funds you actively trade with
• fee tokens, margin collateral (if you actually use it)
• short-term positions you’re willing to manage inside the platform

Keep off-exchange (self-custody):

• long-term holdings you’d hate to be locked out of for days
• anything you’d call “savings”
• the coins you don’t need for weekly trading

This isn’t fear-mongering. It’s basic exposure control. If a hot/warm wallet event triggers another withdrawal pause, you’re not stuck watching from the sidelines.

Build an “exit plan” while things are calm

Most people set this up during a crisis. That’s backwards.

Here’s a clean exit plan you can prep in under an hour:

1. Pre-verify withdrawal addresses

• Add your personal wallet addresses now.
• Label them clearly (e.g., “My BTC wallet”, “My ETH main”).

2. Turn on address whitelisting (if the exchange supports it)

• Only allow withdrawals to addresses you approved.
• If whitelisting has a cooldown, that cooldown is your friend.

3. Keep backups you can actually use

• Seed phrase backups stored safely (offline, not in screenshots).
• A second device or recovery method for your authenticator app.

4. Know your networks before you need them

• If you hold USDT, decide which chains you trust and can receive on.
• Don’t pick a network under pressure because fees “look cheap.”

Your blind spot: personal data during incident chaos

When an exchange is in the news, phishing spikes. Attackers don’t need to break the exchange again. They just need to trick stressed users into handing over login codes, clicking fake reset links, or “confirming” a withdrawal address.

A very practical way to reduce fallout is to separate your exchange identity from your real-life identity:

• a dedicated email for exchange logins
• a dedicated phone number for exchange SMS/recovery (even if you prefer app-based 2FA)

This is where Cloaked fits cleanly. Cloaked lets you create separate emails and phone numbers for accounts like crypto exchanges, so your primary inbox and real number don’t become the default target when scammers start blasting “urgent security updates.” If an exchange signup dataset leaks or gets targeted, you can shut off the alias instead of playing defense on your main identity.

None of this makes you bulletproof. It just makes you harder to hit—and way easier to recover when something breaks.

‍