Bitget says Bitcoin withdrawals are open after $387M hack, but ETH and USDT must wait

At about 04:20 UTC Monday, Bitget's public feed showed BTC and ETH futures trades taking place after the exchange's Sept. 24 security breach. On Sept. 28, Bitget said it had opened BTC withdrawals on the Bitcoin network, the first stage of its phased plan. The notice says the service is open; it does not document a completed customer withdrawal. Trading activity and the ability to send assets off the exchange face separate tests.

Bitget said its security systems detected unauthorized transfers from some hot wallets at 18:31 UTC on Sept. 24. It suspended withdrawals while keeping trading and deposits open. The exchange initially estimated affected assets at about $351.6 million. A Sept. 25 update raised the estimate to approximately $387.5 million after it identified more transactions from the original incident; Bitget said the revision did not reflect additional unauthorized transfers.

Bitget says customer balances remain unaffected and its Protection Fund will cover the incident's financial impact. Those assurances come from the exchange. The practical question for customers is whether they can successfully transfer assets or trading proceeds out of their accounts.

The company's phased reopening plan sets 08:00 UTC for each of these dates:

The first scheduled restart was still ahead when the public trading snapshot was taken at 04:20 UTC. Bitget has since said BTC withdrawals on Bitcoin are open. Its service notice does not establish whether individual transfers have completed. A customer with ETH on a network scheduled for Sept. 29, for example, would face a different timetable from a customer withdrawing BTC on Bitcoin.

Bitcoin withdrawals and futures trading are separate tests

Bitget's public trade feed returned 100 BTCUSDT futures fills between 04:20:25 and 04:20:49 UTC on Sept. 28. It returned 100 ETHUSDT fills between 04:20:34 and 04:20:52 UTC. Those records show that the two USDT-margined contracts matched trades during those seconds. The records cover those two contracts and those seconds; other markets and customer-specific execution prices remain outside their scope.

A separate snapshot around 04:21 UTC showed $22.14 million of displayed BTC futures buy and sell orders and $10.29 million of ETH orders within 0.05% of each contract's midpoint. That band counts orders priced no more than 0.05% away from the middle of the best buy and sell quotes. The BTC quoted spread was about 0.012 basis points and the ETH spread about 0.038 basis points.

A hypothetical $500,000 sell against the displayed buy orders would have averaged 0.0095% below the BTC midpoint and 0.0183% below the ETH midpoint, before fees. The calculation models a static book; no customer order produced those prices. Orders can be canceled, replenished or changed while a trade is placed. The snapshot captures one moment during the withdrawal suspension.

A TokenInsight study provides the historical comparison. Sampling nine venues every 30 minutes from Aug. 16 through Sept. 14, it put Bitget first for combined BTC and ETH futures depth within the wider 0.05% band, at a $41.60 million median. At the tighter 0.03% band, Bitget ranked third at $15.25 million, behind MEXC and Hyperliquid. The study ended before the breach. Their different windows and methods preclude a measured before-and-after change or a current peer ranking.

A futures book measures displayed interest in a derivative. Withdrawal access requires separate evidence about conversion and transfers across the intended network. The public fills establish trading in two contracts at a particular time; Bitget's timetable and its BTC reopening notice describe the phased return of off-platform transfers. The next observable test is whether Bitcoin withdrawals complete in practice, followed by each asset and network in the plan.