Bitget has resumed Ethereum withdrawals following the cryptocurrency exchange’s $387.5 million hack, marking a significant step in the restoration of services after withdrawals were suspended in response to the September 24 breach. The exchange is bringing withdrawal functionality back online in phases rather than reopening every affected asset and network simultaneously, allowing its security teams to verify upgraded wallet infrastructure before restoring additional routes. Bitget initially estimated the attack at approximately $351.6 million before revising the total to $387.5 million after incorporating additional Zcash and TRON assets that were not included in its preliminary accounting.
The company has stressed that the higher figure does not represent a second attack or additional drain after the incident. The approximately $388 million figure cited in subsequent reporting is a rounded version of Bitget’s revised $387.5 million total. Trading and deposits largely remained operational during the response, while withdrawals were temporarily suspended as Bitget investigated the breach and rebuilt affected wallet infrastructure.
Ethereum Withdrawals Return After Security Checks
The restoration of ETH withdrawals indicates Bitget has completed enough of its security review and wallet migration process to begin reopening one of its most important blockchain routes. However, the phased approach means users should not interpret Ethereum’s reopening as confirmation that every cryptocurrency and blockchain supported by Bitget is immediately available for withdrawals. The September 24 incident affected portions of Bitget’s hot and warm wallet infrastructure across multiple networks, while the exchange said its cold wallets remained secure. Affected assets included ETH, XRP, USDT, USDC, ZEC, TRX, BNB, AVAX and other tokens distributed across Ethereum-compatible networks, XRP Ledger, TRON and Zcash.
Bitget has said the attackers did not obtain its private keys. Security analysis from GoPlus instead described the breach as a compromise of the exchange’s transaction-signing trust chain. According to that assessment, attackers penetrated critical backend infrastructure and supplied fraudulent transaction information to an authorized signing process. The resulting transactions therefore carried valid cryptographic signatures even though Bitget had not legitimately intended to authorize them.
Recovery Effort Extends Across Crypto Industry
Bitget says the underlying vulnerability has been remediated and is working with cybersecurity companies including Mandiant and SlowMist as the forensic investigation continues. The exchange has also notified law-enforcement authorities and launched efforts to trace and recover the stolen assets. Those efforts have increasingly involved infrastructure elsewhere in the crypto ecosystem. NEAR Intents said its screening systems rejected attempts to route more than $50 million linked to the Bitget exploiter through its cross-chain infrastructure and froze another approximately $503,000 that had entered its system. The attacker also attempted to use Chainflip to move stolen assets, but a broker screening transactions before they entered the protocol rejected the attempted route.
Such interventions demonstrate the difficulty hackers face when trying to convert hundreds of millions of dollars in publicly traceable cryptocurrency without interacting with exchanges, bridges, stablecoin issuers or cross-chain services capable of identifying flagged addresses. For Bitget, restoring withdrawals is now the most visible stage of the recovery process. The exchange has maintained that customer balances remain fully backed and pointed to its User Protection Fund, which was worth more than $464 million around the time of the incident, as an additional financial safeguard. Ethereum’s reopening therefore represents an important operational milestone, but not the end of the incident response. Bitget still needs to restore remaining withdrawal routes, complete its forensic investigation and determine whether additional stolen assets can be recovered. For users, the key development is that funds are beginning to move off the exchange again as Bitget transitions from emergency containment toward a phased restoration of normal wallet operations.