Bitget Reopens Bitcoin Withdrawals as Protection Fund BTC Moves

All news is rigorously fact-checked and reviewed by leading blockchain experts and seasoned industry insiders.

• BTC withdrawals reopened September 28, with ETH and USDT next.
• Bitget’s affected-funds estimate has increased to about $387.5 million.
• Protection Fund transfers to hot wallets are not customer withdrawals.

Bitget has started restoring withdrawals four days after the September 24 security incident, with Bitcoin withdrawals reopening at 08:00 UTC on September 28.

The restart comes as part of a phased rollout extending through October 2. Bitget says the exploited vulnerability has been remediated, no additional unauthorized transfers have been identified since containment and user account balances remain unaffected.

Bitget has begun the phased resumption of withdrawals following the security incident identified on September 24, with BTC withdrawals on the Bitcoin network started at 08:00 UTC on September 28 as scheduled.

The resumption follows additional security work across Bitget’s…

— Bitget (@bitget) September 28, 2026

But another development is visible on-chain. More than 2,000 BTC reportedly moved from Bitget’s Protection Fund into hot wallets ahead of the reopening, providing a look at how the exchange is positioning liquidity while normal withdrawal activity resumes.

Bitget Is Restoring Withdrawals in Stages

Bitcoin is the first major asset to return, rather than the exchange reopening every withdrawal route simultaneously.

Bitget’s announced schedule puts ETH withdrawals next on September 29, followed by USDT on September 30.

Remaining tokens, fiat withdrawals and P2P services are scheduled for October 2.

Deposits and trading remained operational during the withdrawal suspension.

The staged approach gives Bitget an opportunity to validate withdrawal infrastructure under live conditions before restoring the full range of services.

Restoration Schedule

The Estimated Impact Has Increased

Bitget initially estimated approximately $351.6 million was affected by unauthorized transfers involving portions of its hot and warm wallet infrastructure.

Its subsequent incident review increased the figure to approximately $387.5 million after additional Zcash and TRON transactions were included.

Bitget has maintained that its cold wallets were not compromised and that customer account balances remain unaffected. The company has also said its User Protection Fund would cover the financial impact.

That fund was valued above $464 million around the time of the incident, but the dollar figure alone does not show how much coverage is available.

A substantial portion of the reserve is denominated in Bitcoin, meaning its USD value changes with BTC’s market price.

Protection Fund Movements: Liquidity vs. Reserves

On-chain analyst ai_9684xtpa reported in X, that 2,042.28 BTC, worth roughly $169 million at the cited price, moved from Bitget’s approximately 5,500 BTC Protection Fund holdings into hot wallets.

Another 3,457.72 BTC remained in the tracked fund addresses, according to the analysis.

Those transfers should not be counted as $169 million of customer withdrawals.

Moving BTC from a reserve address to an operational hot wallet is an internal on-chain transfer. Determining whether those coins were subsequently withdrawn by customers requires following what happens after they reach the operational wallets.

This is particularly relevant immediately after an exchange reopens withdrawals. Pre-positioning assets can provide hot wallets with liquidity before customer requests begin arriving.

It also means snapshots of the Protection Fund require context. Coins moving out of a labeled fund address do not necessarily mean that value has already been spent covering losses.

The $464 Million Figure Is Not Fixed

The composition of Bitget’s Protection Fund makes its headline valuation sensitive to Bitcoin.

If approximately 5,500 BTC represents a substantial portion of the reserve, the fund can gain or lose tens of millions of dollars in reported value without Bitget adding or removing any Bitcoin.

That makes three figures more informative than a single dollar valuation: how many assets remain in the fund, where they are held and how much Bitget ultimately needs to replenish after absorbing the incident’s losses.

CEO Gracy Chen previously said Bitget intends to restore the Protection Fund to its $300 million baseline within a week.

The post-incident fund composition will therefore provide a more useful measure of coverage than its value at one particular Bitcoin price.

Bitget Says the Attack Did Not Begin With Stolen Private Keys

Bitget’s account of the exploit also differs from the familiar exchange-hack scenario in which attackers obtain wallet private keys.

According to the exchange’s investigation, the attacker compromised a critical backend component and manipulated transaction data in a way that caused unauthorized transfers to pass through the approval process.

Bitget says the vulnerability has since been remediated.

The company is working with external cybersecurity specialists including Mandiant and SlowMist as the investigation continues. Their involvement should not, however, be interpreted as independent confirmation of every figure or conclusion Bitget has published unless the firms separately verify them.

October 2 Becomes the Operational Checkpoint

Bitcoin withdrawals returning is evidence that Bitget is comfortable reopening one part of its infrastructure. It is not yet the same as full normalization.

The remaining checkpoints are concrete.

ETH and USDT need to return on schedule. The broader withdrawal system needs to reach the planned October 2 reopening. No additional unauthorized transfers need to emerge. And Bitget still has to show how the Protection

Fund looks after the financial impact of the breach is absorbed.

Those figures will provide a clearer measure of the recovery than the amount of Bitcoin leaving the exchange immediately after withdrawals reopen.

Source