# Bitget customers pulled more than 4,000 bitcoin within an hour of withdrawals reopening

The exchange says attackers reached internal network credentials through a third-party security product and issued withdrawal instructions that bypassed risk controls, while cold wallets and private keys stayed intact.

- Published: 2026-09-30T06:00:33.939Z
- Canonical: https://polylog.news/crypto/2026-09-30/bitget-customers-pulled-more-than-4-000-bitcoin-within-an-ho
- Publisher: Polylog (Crypto desk)
- Section: crypto
- Sources: [Bitcoin Magazine](https://bitcoinmagazine.com/news/bitget-customers-withdraw-4000-bitcoins), [Cointelegraph](https://cointelegraph.com/news/bitget-btc-withdrawal-hacker-eth-swap-thorchain), [BleepingComputer](https://www.bleepingcomputer.com/news/security/bitget-resumes-bitcoin-withdrawals-after-3875-million-crypto-heist/)

Bitget reopened bitcoin withdrawals at 08:00 coordinated universal time on 28 September, four days after it froze them, and customers moved more than 4,000 bitcoin off the exchange in the first hour, [Bitcoin Magazine reported](https://bitcoinmagazine.com/news/bitget-customers-withdraw-4000-bitcoins). At prices near $83,000, that is over $330 million leaving in sixty minutes. Ether withdrawals followed across Ethereum, BNB Smart Chain, Arbitrum, Base and Optimism, and Tether withdrawals across Ethereum, BNB Smart Chain, Solana and Tron, [according to BleepingComputer](https://www.bleepingcomputer.com/news/security/bitget-resumes-bitcoin-withdrawals-after-3875-million-crypto-heist/).

The loss is roughly $388 million. Bitget's account of the breach places it outside the blockchain entirely. Attackers exploited a vulnerability in a third-party security product, obtained high-level internal network credentials, and used them to create fraudulent withdrawal instructions that passed the exchange's existing risk controls. The company says its cold wallets and private keys were never compromised and that customer balances remain whole. Part of the stolen value was converted into ether, including through the cross-chain swap protocol THORChain, [Cointelegraph reported](https://cointelegraph.com/news/bitget-btc-withdrawal-hacker-eth-swap-thorchain).

Taken together, the claim that keys were safe and the claim that $388 million left are compatible, and that combination is what makes this incident different from a typical hack. A withdrawal system signs whatever its internal approval pipeline authorizes, so it will process an attacker's instruction as readily as a customer's. Cold storage protects against key theft. It does not protect against an adversary who becomes, for a period, an authorized operator. Vendor software inside the security perimeter is now part of the custody model whether or not it appears in a proof-of-reserves attestation.

The withdrawal surge served as a real-time test of solvency. Reserve attestations are periodic and backward-looking, while a withdrawal queue that clears is a live test of whether the exchange can pay. Bitget passed the first hour. The open questions are how much of the $388 million the exchange absorbs from its own capital, whether any of the converted funds are frozen by counterparties, and what the third-party product was, which the exchange has not named.

## What this means

The mechanism is operational compromise rather than cryptographic failure. An attacker who obtains privileged internal credentials inherits the exchange's own authority to move funds, so spending on key custody does not reduce the loss. Exposed parties are Bitget's balance sheet, its customers' willingness to hold balances there, and by extension every venue that relies on third-party security and monitoring software inside its approval pipeline. The precedent is the pattern of the past two years, in which the largest venue losses came from signing-workflow and infrastructure compromise rather than protocol bugs, and in those cases the exchange covered the deficit while deposits recovered slowly. The likelier outcome over the next weeks is continued net outflows from Bitget toward larger venues and self-custody, with the pace depending on whether the exchange publishes a named root cause and a full reserve attestation. If it does neither and outflows persist into a second month, the more serious risk becomes a funding problem rather than a security problem.

## What to watch

- Whether Bitget names the third-party product that was exploited, which would let other exchanges check the same dependency.
- Whether an updated proof-of-reserves attestation shows the $388 million absorbed by company capital rather than customer assets.
- Whether any of the converted ether is frozen by stablecoin issuers or exchanges, which would show how much cross-chain swap routes still leak attribution.