Bitget customers pulled more than 4,000 bitcoin within an hour of withdrawals reopening

Bitget reopened bitcoin withdrawals at 08:00 coordinated universal time on 28 September, four days after it froze them, and customers moved more than 4,000 bitcoin off the exchange in the first hour, Bitcoin Magazine reported. At prices near $83,000, that is over $330 million leaving in sixty minutes. Ether withdrawals followed across Ethereum, BNB Smart Chain, Arbitrum, Base and Optimism, and Tether withdrawals across Ethereum, BNB Smart Chain, Solana and Tron, according to BleepingComputer.

The loss is roughly $388 million. Bitget's account of the breach places it outside the blockchain entirely. Attackers exploited a vulnerability in a third-party security product, obtained high-level internal network credentials, and used them to create fraudulent withdrawal instructions that passed the exchange's existing risk controls. The company says its cold wallets and private keys were never compromised and that customer balances remain whole. Part of the stolen value was converted into ether, including through the cross-chain swap protocol THORChain, Cointelegraph reported.

Taken together, the claim that keys were safe and the claim that $388 million left are compatible, and that combination is what makes this incident different from a typical hack. A withdrawal system signs whatever its internal approval pipeline authorizes, so it will process an attacker's instruction as readily as a customer's. Cold storage protects against key theft. It does not protect against an adversary who becomes, for a period, an authorized operator. Vendor software inside the security perimeter is now part of the custody model whether or not it appears in a proof-of-reserves attestation.

The withdrawal surge served as a real-time test of solvency. Reserve attestations are periodic and backward-looking, while a withdrawal queue that clears is a live test of whether the exchange can pay. Bitget passed the first hour. The open questions are how much of the $388 million the exchange absorbs from its own capital, whether any of the converted funds are frozen by counterparties, and what the third-party product was, which the exchange has not named.