Bitget Reopens Bitcoin Withdrawals Monday at 08:00 UTC. A 5-Step Exit That Survives the Phishing Wave

What Happened

Bitget published its reopening plan on September 26, about 34 hours after the September 24 theft. Withdrawals return in 4 phases, each at 08:00 UTC: bitcoin on the Bitcoin network on Monday, September 28; ether on Ethereum, BNB Smart Chain, Arbitrum, Base, and Optimism on September 29; USDT on Ethereum, BNB Smart Chain, Solana, and Tron on September 30; and other tokens, fiat, and peer-to-peer services on October 2.

The exchange said the vulnerability 'has been identified and remediated' and that Mandiant and SlowMist continue to support the investigation. On Friday it raised the loss to about $387.5 million from the $351.6 million first reported, after adding Zcash and Tron balances the first count missed, and repeated that its protection fund, valued above $464 million, covers the loss.

Chief executive Gracy Chen has called North Korean involvement 'very likely,' and Elliptic assessed the link as 'highly likely'; no law-enforcement attribution has been made.

The recovery side is thinner. Circle blacklisted an address tagged Bitget Exploiter 8 at 05:00 UTC on Friday and Tether followed, per SlowMist's MistTrack tool: 218,023 USDT and 99,990 USDC, about $318,000. MistTrack showed other attacker addresses holding more than 63,000 ETH, which no issuer can freeze.

On Saturday, CoinDesk reported that about $83 million of the roughly 102.9 million XRP taken had moved out of 3 holding wallets, with about $75 million still parked. The XRP Ledger lets issuers freeze the tokens they issue on it; XRP itself, the native asset with no issuer behind it, cannot be frozen by anyone, per the ledger's own documentation.

Bitget's answer is a market: a bounty of 5% for any party that freezes stolen funds and a further 5% for recovery, routed in part through Bybit's LazarusBounty platform. The freezes so far cover about 0.08% of the loss.

For 4 days a Bitget balance has been a claim the operator has not yet chosen to honor. Monday's window turns it back into a coin, and the move to your own keys is where the responsibility, and the unrecoverability, change hands.

Why the Recovery Is Not Your Plan

Freeze authority reaches liabilities. A USDT or USDC balance is a claim on Tether or Circle, and each issuer keeps a blacklist; on the XRP Ledger, issued tokens sit in trust lines an issuer can freeze. Bitcoin, ether, and XRP are nobody's liability, so there is no counterparty to call.

That is why, per Wu Blockchain's timeline, one of the attacker's first moves was to swap 19.67 million USDT into 7,111 ETH on Arbitrum in about 6 minutes at up to 5% over market: as much as $1 million paid to get out from under a switch, and the mirror image of the 5% Bitget now offers anyone who can throw one.

The switch is real, as the Tether freeze this site covered on September 3 showed. What this week documents is its reach, and against a thief who moves in minutes the reach is short.

For a customer the arithmetic points elsewhere. The protection fund, 5,500 BTC by Bitget's monthly valuation reports, makes the loss the exchange's problem, and on its statements no customer will be short. What remains yours is the exit. For 4 days a Bitget balance has been a number the exchange has chosen not to redeem yet.

Bybit processed about 350,000 withdrawal requests within 10 hours of its own $1.5 billion theft in February 2025 and never closed the door; Bitget's door opens by asset class over 5 days, on the operator's timetable. That is what an exchange balance is: a claim whose convertibility the custodian controls.

It says nothing about whether Bitget will pay. It says the window belongs to the operator, and the days around a reopening are when the criminals who could not touch the stolen coins come for the customers who can still move theirs.

The Exit Procedure

Step 1, today: prepare the account for a window you do not control. Bitget's security settings run on a 24-hour clock. Per its account-security pages, adding an address to the withdrawal whitelist, changing the login password, updating 2-factor authentication (2FA), or modifying the fund code restricts withdrawals for 24 hours, so a whitelist entry created on Sunday works on Monday morning and one created Monday does not.

Set the anti-phishing code under Profile, then Security: an 8-to-32-digit string Bitget includes in every genuine email and SMS apart from verification codes, so a message without it is fake by definition. Revoke any application programming interface (API) key you do not actively use; the September 9 Trezor campaign began with unauthorized API keys created inside a vendor's account.

Do not rotate your password or 2FA this week unless you must, because the change itself locks you out of the window.

Step 2, the destination: generate a fresh receive address on a hardware wallet you control and confirm it on the device screen before it touches a clipboard. For bitcoin, use a native Segregated Witness (SegWit) address, the kind that starts with bc1q, that has never received funds, and do not reuse it afterward.

Whitelist that address and no other. Step 3, Monday: send a small test amount first, watch it confirm on a block explorer you opened yourself, then send the rest. Expect a queue; a reopening after a 4-day pause pushes a week of demand into 1 hour. If your balance is in an asset whose phase comes later, converting it to bitcoin on the exchange to leave Monday is a trade with a spread and, in most jurisdictions, a taxable disposal.

Decide that on the merits, not on nerves.

Step 4, the inbox: verification runs one way. You open the app you already have installed or type bitget.com yourself, and you act on nothing that arrives, including mail that passes every authentication check, because September's Trezor and BitBox phish came through the vendors' own sending domains.

Bitget warned on September 25 of accounts impersonating its channels. The lures write themselves: 'priority withdrawal' for a fee, 'complete verification to unlock withdrawals,' 'claim your compensation,' a support account that messages you first. Bitget says it will never ask for a password, a 2FA code, or a seed phrase, and no compensation process needs your recovery words.

Step 5, after: confirm the coins on-chain, export your transaction history while the account is open, then decide what the exchange is for. If it is where you trade, keep working capital there and nothing else.

What This Means for You

Name what moved. Withdrawing to a hardware wallet ends the custodial risk that put your coins behind a 4-day pause; it does not end the risk in the pipeline that assembles and signs transactions, which is what failed at Bitget. From Monday that pipeline is your laptop, your wallet software, and the device screen where the address you meant and the address you are about to sign for either match or do not.

A hurried exit is when people paste, and a clipboard-swapping infection is far cheaper than a backend compromise. Verify on the device every time.

Then read the freeze figures for what they say about your own coins. The rule that keeps the attacker's XRP and ether out of every issuer's reach is the rule that keeps self-custodied bitcoin out of every issuer's reach, and it cuts both ways: a native asset stolen from you is recoverable by nobody either unless the thief hands it to a custodian willing to act, and no protection fund stands behind your private keys.

Seizure resistance and unrecoverability are 1 property, not 2. Hold long-term coins that way, size the custodial surface to what you need to trade, and keep stablecoins for what they are: an issuer's IOU with a switch that this week reached 0.08% of a thief's take.

What to Watch

The root-cause report is still the first checkpoint: whether it names the compromised component and the entry path, and whether a vendor sits in it. Monday at 08:00 UTC will show whether the schedule holds and what per-account limits or delays come with it. Watch the Protection Fund's next monthly valuation for a drawdown and the bounty page for any freeze beyond the $318,000.

The first confirmed loss to a Bitget-themed phish would move the wave from predicted to costed, and any movement of the parked XRP or the 63,000 ETH toward an exchange or an over-the-counter desk is where the tracing, and the bounty, get their chance.

Tracked entities this report names, with total coverage across the archive. Follow one into the Actor Network to see every report it appears in.

Other reports that name the same tracked actors — a different thread than “related,” which follows wording. These are linked by who appears in them.