Bitget Bitcoin withdrawals have resumed following a suspension triggered by what the exchange says was a breach carried out by North Korean hackers, who transferred $387.5 million to attacker-controlled addresses in one of the largest crypto thefts on record. The platform says it has patched the exploited vulnerability and is working through a phased schedule to restore withdrawals across all supported assets.
What happened and when withdrawals return
Bitget suspended all withdrawals on Thursday after its security systems detected multiple unauthorised transfers from a limited number of crypto wallets. The company subsequently confirmed that attackers had stolen $351.6 million from its hot and warm wallets before a later on-chain tracing exercise revised the total upward to $387.5 million.
CEO Gracy Chen said the attack touched the Ethereum, XRP Ledger, Arbitrum, Avalanche, Optimism, BSC, and Base chains, with affected assets including ETH, XRP, BNB, AVAX, USDT, USDC, and other tokens. According to Chen, attackers breached a critical backend system within Bitget’s wallet infrastructure and used it to spoof transaction data, which triggered the exchange’s own authorisation process to move funds out of the compromised wallets.
The phased withdrawal resumption schedule runs as follows: ETH (Ethereum, BSC, Arbitrum, Base, Optimism) returns on 29 September at 08:00 UTC; USDT (Ethereum, BSC, Solana, Tron) on 30 September at 08:00 UTC; and other tokens, fiat, and P2P assets from 2 October at 08:00 UTC.
North Korean IP traces and third-party investigators
Chen attributed the attack to North Korean state-sponsored hackers, citing on-chain analysis and IP behaviour patterns. CNBC reported that investigators identified internet protocol addresses linked to VPN services previously used by a North Korean hacking group. That kind of infrastructure fingerprinting has become a fairly standard part of attribution in major crypto heists, though formal confirmation from law enforcement agencies remains a separate matter.
Bitget has also brought in outside help. According to Fortune, the company announced a partnership with third-party experts Mandiant and SlowMist to investigate the incident, a move that should eventually produce a more granular account of how the backend system was compromised.
Protection Fund and the recovery bounty
Bitget has been at pains to reassure users that account balances remain unaffected. ‘The temporary withdrawal pause remains a security measure and is not related to the availability of user assets,’ the company said in a statement. ‘User account balances remain unaffected, and Bitget’s Protection Fund covers the financial impact of this platform-wide incident.’
The Record from Recorded Future News reported that Bitget’s User Protection Fund holds over $464 million, and those funds will be used to cover the losses arising from the incident. The company has also launched a Recovery Bounty Programme, offering 5% bounties for helping to recover or freeze stolen funds.
A pattern of North Korean crypto theft
The Bitget attack sits within a broader and worsening trend. North Korean-linked hackers stole a record $2 billion in cryptocurrency in 2025, according to blockchain analytics firm Chainalysis, as cited by Fortune. The scale of state-sponsored crypto theft has accelerated sharply over recent years: British blockchain analytics firm Elliptic estimated in February 2025 that North Korean hackers have ‘stolen over $6 billion in crypto assets since 2017.’
The largest single incident in that run remains the Bybit breach, in which $1.5 billion was taken from the exchange’s ETH cold wallet. The Bitget theft now places itself among the top tier of recorded crypto heists, and the involvement of Mandiant and SlowMist suggests the investigation’s findings, when they come, will be watched closely across the industry.
Trading and deposits on Bitget have continued operating throughout the incident, and the company says no further unauthorised transfers are possible. The Recovery Bounty Programme is live, with the 2 October date for remaining asset withdrawals the next concrete milestone.
