Bitget Tests Its Final Promise Eight Days After the Hack

Bitget's phased withdrawal schedule reaches its final step today, 2 October, with remaining altcoin tokens, fiat withdrawals, and peer-to-peer services due to reopen at 08:00 UTC, eight days after a $387.5 million hot-wallet breach drained the exchange. Chief Executive Officer Gracy Chen confirmed the timeline on 30 September, stating that P2P withdrawals would go live alongside all other remaining services. The exchange said regular customers, key opinion leaders, and VIP account holders would receive access simultaneously, with no priority channel for any user tier.

The Four-Step Schedule and Whether Each Step Landed

Bitget published a four-phase withdrawal schedule on 28 September, beginning with Bitcoin on the Bitcoin network and expanding one asset class at a time. Each phase was set for 08:00 UTC on its designated date. The Block reported that the exchange processed 9,585 Bitcoin withdrawals totalling 4,098 BTC within the first hour of Phase 1.Phase 2 opened Ether withdrawals on 29 September across the Ethereum, BSC, Arbitrum, Base, and Optimism networks. Phase 3 followed on 30 September with USDT on Ethereum, BSC, Solana, and Tron. Phase 4, scheduled for today, covers every remaining token along with fiat currency withdrawals and peer-to-peer trading.The first three phases were completed on schedule; whether the final phase launched on time at 08:00 UTC today should be confirmed on Bitget's official announcements page before treating the operational recovery as complete.

$387.5 Million Lost, Protection Fund Absorbs the Hit

Attackers drained approximately $387.5 million from Bitget's hot and warm wallets on 24 September at around 18:31 UTC, making it the largest crypto exchange hack of 2026. Bitget's initial security notice placed the figure at $351.6 million; the exchange later updated the total to $387.5 million after identifying additional compromised Zcash and TRON assets.Chen said the exchange's Protection Fund, originally established in 2022 with 5,500 BTC, absorbed the financial impact. By 30 September, the fund had been restored to $309 million (3,705 BTC), roughly $9 million above its $300 million floor and 1,795 BTC fewer than its pre-breach level. Bitget's 47th proof-of-reserves report showed 131% overall coverage across 19 audited cryptocurrencies, with BTC at 142%, ETH at 110%, USDT at 107%, and USDC at 154%.

Stolen Funds Trail Leads Through THORChain and Zcash

TRM Labs found that the attackers split stolen assets into newly created wallets holding round amounts within hours, then routed the bulk through THORChain into Bitcoin using peel-chain techniques. Smaller portions moved through Across, Bridgers, Chainflip, and FixedFloat. Approximately $3.8 million in ZEC had been moved into Zcash's shielded pool as of 1 October, using zero-knowledge proofs to sever the address-to-address trail. Chen said during a livestream on X that Bitget had identified IP addresses matching VPN infrastructure associated with a North Korean group, though definitive attribution remained pending.The exchange offered a 5% bounty for actions directly resulting in stolen funds being frozen or recovered, and confirmed that Mandiant and SlowMist are assisting the investigation.

What Users Should Verify Before Withdrawing

The exchange recorded $463 million in net outflows during the 24 hours ending 29 September, the largest single-day withdrawal tracked by DefiLlama in four years, representing over 10% of Bitget's reserves. However, $231 million in deposits returned within 24 hours of the breach response, suggesting a partial restoration of user confidence.Users attempting withdrawals today should confirm that the asset and network they need are live on Bitget's withdrawal status page. They should also verify that their account's two-factor authentication settings remain intact after the breach and review any pending transactions that may have been queued during the suspension period.

The Final Withdrawal Phase Will Test Bitget’s Recovery

The completion or delay of today's final phase will close or extend Bitget's operational recovery timeline. The investigation into the attack vector, which Chen described as an exploitation of a backend wallet-processing system that made fraudulent withdrawals appear legitimate to Bitget's internal authorization process, continues with Mandiant and SlowMist. The exchange has said the attackers did not steal private keys.