Cryptocurrency exchange Bitget has resumed Bitcoin withdrawals that were suspended last week after suspected North Korean hackers breached its systems and stole hundreds of millions of dollars in digital assets. The company says it has patched the vulnerability exploited in the attack and is restoring services for other assets on a staggered schedule.
Bitget plans to resume Ethereum withdrawals (covering Ethereum, BSC, Arbitrum, Base, and Optimism networks) on September 29 at 8:00 UTC, USDT withdrawals (Ethereum, BSC, Solana, Tron) on September 30 at 8:00 UTC, and withdrawals for remaining tokens, fiat, and P2P assets starting October 2 at 8:00 UTC.
The exchange emphasized that the pause was a precautionary security measure rather than a sign of missing funds. “User account balances remain unaffected, and Bitget’s Protection Fund covers the financial impact of this platform-wide incident,” the company said, adding that the incident is contained and no further unauthorized transfers are possible.
How the breach happened
Bitget first suspended all withdrawals last Thursday after security systems flagged unauthorized transfers from a limited number of wallets. The company later confirmed attackers had stolen $351.6 million from its hot and warm wallets, a figure it subsequently revised upward to $387.5 million based on further on-chain tracing.
Bitget CEO Gracy Chen said the incident spanned seven blockchains, Ethereum, XRP Ledger, Arbitrum, Avalanche, Optimism, BSC, and Base, and affected multiple assets including ETH, XRP, BNB, AVAX, USDT, and USDC. According to Chen, attackers breached a critical backend system within Bitget’s wallet infrastructure and used it to spoof transaction data, tricking the exchange’s authorization process into releasing funds from compromised wallets.
Chen attributed the attack to North Korean state-sponsored hackers, citing on-chain analysis and IP behavior patterns consistent with previous campaigns. Bitget has since launched a Recovery Bounty Program offering a 5% reward for help recovering or freezing the stolen funds.
Part of a broader pattern
North Korean threat groups have been linked to numerous major cryptocurrency thefts in recent years, including the record-breaking $1.5 billion theft from Bybit’s Ethereum cold wallet. Blockchain analytics firm Elliptic estimated in February 2025 that North Korean hackers have stolen more than $6 billion in crypto assets since 2017, underscoring the persistent threat these groups pose to exchanges handling large volumes of digital assets.