Bitget reopened Tether withdrawals on Wednesday at 08:00 UTC, the third stage of a phased restart after the $387.5 million breach of September 24. Customers had already pulled a record $463 million from the exchange in a single day, while its latest proof-of-reserves report shows all 19 listed assets above 100% coverage.The USDT restart covers four networks: Ethereum, BNB Smart Chain, Solana and Tron. It follows bitcoin withdrawals on September 28 and ether on September 29. Remaining tokens, fiat rails and peer-to-peer trading come back on October 2, six days after the exchange froze platform-wide withdrawals.
Record outflow, but reserves hold
Bloomberg reported that Bitget recorded about $463 million in net outflows in the 24 hours into Tuesday, September 29. DefiLlama, which tracks on-chain balances of crypto platforms, called it the largest one-day net outflow it has recorded for Bitget since it began tracking exchange reserve data roughly four years ago.The exchange’s 47th proof-of-reserves report, based on a snapshot taken at 09:00 UTC on September 29, is the first published since the breach. Overall coverage stands at 131%, down four percentage points from the previous monthly report. Every listed asset remains above 1:1.
| Asset | Reserve ratio |
|---|---|
| NEAR Protocol | 181% |
| Tether Gold | 172% |
| Solana | 157% |
| USD Coin | 154% |
| Bitcoin | 142% |
| Chainlink | 137% |
| Ether | 110% |
| Tether (USDT) | 107% |
| XRP | 107% |
| BNB | 104% |
The ratios measure something different from the outflow figure. The reserve report compares assets held against customer balances at one point in time. The outflow number records what customers did once withdrawals reopened. Both matter for the same question: whether the exchange can meet its obligations while under stress.
Protection fund more than half spent
The User Protection Fund, Bitget’s emergency reserve for covering user losses, has fallen below $200 million, Bloomberg reported on September 29. When the breach was disclosed, the exchange said the fund held more than $464 million and that the loss fit within that coverage. The fund has since absorbed about $264 million of the $387.5 million theft, a drop of more than 57%.
“The fund is being used to absorb the financial impact of the incident,” Bitget CEO Gracy Chen told Bloomberg by email.
The fund launched in 2022 with a $300 million commitment and is backed in part by 5,500 BTC, so its dollar value moves with the bitcoin price. Bitget has said it will replenish the fund but has not said when or by how much. The report’s Merkle Tree verification lets users confirm their balance was included in the September 29 snapshot. It does not show whether the fund could absorb another incident of similar size.
How the breach unfolded
Bitget’s security systems flagged unauthorized transfers from parts of its hot and warm wallets at 18:31 UTC on September 24. Hot wallets are connected to the internet to process routine withdrawals. Warm wallets sit between hot wallets and offline cold storage. The first two transfers, 0.84 ETH and 93 TRX, fell below the exchange’s risk-control threshold. Large transfers began at 18:58 UTC.Between 18:58 and 21:23 UTC, the attacker initiated 17 large withdrawals across Ethereum, the XRP Ledger, Zcash, BNB Smart Chain, Base, Arbitrum, Optimism and Avalanche. Bitget’s reconciliation system flagged a discrepancy at 19:05 UTC, seven minutes after the first large transfer, and platform-wide withdrawals were then blocked. Funds kept leaving the affected wallets until 21:23 UTC. An independent review by blockchain security firm GoPlus Security, published September 26, placed the largest wave at about $185 million in roughly one minute around 19:16 UTC, including 13,966 ETH on Ethereum, about 91.4 million XRP and 20.6 million TRX.Bitget first estimated the loss at $351.6 million, then raised it to about $387.5 million on September 25 after tracing additional Zcash and TRX transfers from the same attack window. The revision covered assets taken during the original breach, not a second attack. The exchange says the attacker exploited a vulnerability in a third-party security product, obtained high-level internal credentials, and injected fraudulent withdrawal commands into wallet backend systems, which treated them as legitimate. Chen has said private keys for cold, hot and warm wallets were not stolen and that user withdrawal requests were not forged.
Who is behind it, and what it means
Chen has said IP address behavior and on-chain patterns resemble earlier operations linked to North Korea. On-chain investigator ZachXBT has connected later laundering flows to operators associated with suspected DPRK actors. Attribution remains a working theory rather than a confirmed finding, and Bitget has not released a final forensic report. The third-party security product involved has not been named publicly.The stolen funds keep moving. The attacker has shifted roughly $83 million in XRP out of three holding wallets, and about $75 million remains in accounts that cannot be frozen under XRP Ledger rules, which give issuers freeze power over tokens they issue but not over XRP itself. Circle and Tether have frozen about $320,000 in related stablecoins. THORChain refused Bitget’s request to block a $6 million swap into bitcoin.
Recovery tools and next steps
Bitget has offered a 5% bounty for freezing attacker funds and a separate 5% bounty for recovery. The company says the vulnerability has been patched, no further unauthorized transfers have been detected, deposits and trading continued throughout the freeze, and customer balances were never altered. A formal security report is due this week.The record so far: hot and warm wallets were compromised, cold wallets were not, reserves covered all 19 listed assets above 1:1 at the September 29 snapshot, customers withdrew a net $463 million in a day, and the protection fund now holds less than half the amount cited when withdrawals were frozen. Whether confidence holds through the USDT restart on Wednesday and the full reopening on October 2 will depend on how those numbers hold up under scrutiny.