Security News

Bitget Resumes Bitcoin Withdrawals After $387.5m Wallet Breach

Infosecurity Magazine · 29 Sept 2026

Key Takeaway Businesses using third-party security tools or platforms should regularly review vendor access permissions and incident response plans, since a single third-party flaw can expose critical infrastructure to compromise.

Cryptocurrency exchange Bitget has reopened Bitcoin withdrawals four days after detecting unauthorized transfers worth approximately $387.5m from part of its hot and warm wallet infrastructure. The exchange first flagged the activity on September 24 and paused withdrawals as a precaution while trading and deposits continued.

Bitget said its investigation, supported by Mandiant and blockchain security firm SlowMist, found that a vulnerability in a third-party security product had allowed an attacker to obtain high-level internal credentials. These credentials were used to send fraudulent withdrawal commands that bypassed the exchange's risk controls. Bitget confirmed the flaw has since been fixed, that cold wallets were unaffected, and that user account balances remain intact. The exchange stated the incident is contained and no further unauthorized transfers are possible.

Bitget said the loss is covered by its Protection Fund, valued at more than $464m. Withdrawals are being restored in phases: Bitcoin resumed on September 28, Ether services follow on September 29, Tether on September 30, with all remaining tokens, fiat withdrawals and peer-to-peer services due back by October 2.

Summarised by CISO AI from Infosecurity Magazine. We link back to every original so you can read it yourself.