Key points

  • Bitcoin withdrawals are scheduled to resume at 08:00 UTC on September 28, followed by Ether on September 29 and USDT on September 30.
  • Other token, fiat and peer-to-peer withdrawals are scheduled to return at 08:00 UTC on October 2.
  • Bitget says it remediated the vulnerability and contained the incident, but the staged reopening still depends on final security validation.

A four-stage reopening starts with Bitcoin

Bitget has set a phased timetable for restoring withdrawals after pausing them during its September 24 security incident. The exchange said Bitcoin withdrawals on the Bitcoin network are scheduled to return at 08:00 UTC on September 28. Ether withdrawals across Ethereum, BNB Smart Chain, Arbitrum, Base and Optimism are due to follow at the same time on September 29. USDT withdrawals on Ethereum, BNB Smart Chain, Solana and Tron are scheduled for September 30, while other tokens, fiat withdrawals and peer-to-peer services are set for October 2. Each stage begins at 08:00 UTC.

The pause remains in place during final checks

The schedule is a plan rather than confirmation that every withdrawal route is already available. Bitget said the vulnerability involved in the incident has been identified and remediated, and that its teams are conducting additional checks on the withdrawal infrastructure. It described the continuing pause as a security measure and said deposits and trading remain operational. Users are not required to take action before the rollout; the platform will display availability as each network returns.

Related reporting: Circle and Tether freeze $318K tied to Bitget exploit

Independent reporting confirms the timetable

CoinDesk independently reported the September 28-to-October 2 reopening schedule while examining movements of XRP taken in the breach. Its ledger review found that about 54 million XRP had left the original holding accounts by Saturday, although transfers alone do not establish that the tokens were sold. That distinction matters because the withdrawal plan concerns Bitget's customer-facing infrastructure, while the movement of attacker-controlled assets is a separate recovery and tracing problem.

Loss estimate rose as more networks were classified

In a separate incident update published September 25, Bitget raised its estimate of assets transferred to attacker-controlled addresses to about $387.5 million from an initial $351.6 million. The company said the revision reflected a fuller accounting that added affected assets on Zcash and Tron, rather than new unauthorized transfers. It listed XRP, ETH, USDT, ZEC, USDC, USDT0, XAUt, BNB, AVAX and TRX among the affected assets and published addresses for monitoring on several networks. The exchange also opened a live tracing dashboard and reporting channel for exchanges, issuers, bridges and security teams monitoring later transfers.

Coverage claims remain company assurances

Bitget says user balances were unaffected and that its Protection Fund will absorb the financial impact. Those are company assurances, not proof that operational risk has disappeared. The exchange also said Mandiant and SlowMist are supporting the investigation, but it has not published a complete forensic report. A staged restart can reduce the load on a recently repaired system and give teams time to monitor each network, yet users still depend on Bitget's controls, liquidity and execution of the announced dates. A delay affecting one stage would not necessarily mean every listed network or asset faces the same problem.

Restoration and recovery remain separate tests

The exchange has also launched a recovery bounty offering 5% of affected funds successfully frozen or recovered when eligible voluntary actions directly produce that result. Legal-process actions are excluded, and Bitget retains discretion over eligibility and payment. CEO Gracy Chen is scheduled to discuss the incident and restoration in an online session at 07:30 UTC on September 28. The immediate test is whether the four withdrawal stages open as announced without new unauthorized activity; recovery of the stolen assets will remain a longer and distinct process.

Sources

AI-generated editorial image; not a photograph of the reported event. Prepared with AI assistance and source verification.