Bitget Restores Bitcoin Withdrawal Services Following $388 Million Hack

Bitcoin withdrawals have been restored by Bitget after an attack diverted almost $387.5 million (roughly Rs. 3,720 crore) to hacker-owned addresses and led the exchange to halt withdrawals on September 24. According to Bitget, BTC withdrawals were opened at 08:00 UTC on September 28 as planned, marking the start of the gradual resumption of operations following security reviews of its withdrawal system. The firm stated that the vulnerability that led to the problem has been patched and that there have been no other unauthorised transactions since then.

Bitget Identifies Backend Wallet Systems as Attack Target

Accounts of users have not been affected, the company claims. While deposits and trading were ongoing, withdrawals have been put on hold, and Bitget claims that its User Protection Fund will compensate for the losses incurred due to the attack. The attack on Bitget that happened on September 24 started at around 18:31 UTC when unauthorised transactions were noticed in parts of the exchange's hot and warm wallet architecture. The company believed that the total sum affected by this was around $351.6 million (roughly Rs. 3,374 crore), but it later increased to about $387.5 million (roughly Rs. 3,720 crore).  

As reported by the CEO Gracy Chen on a live stream on September 28, the intruder was able to exploit a flaw in a security tool used by the company and get access to the high-level credentials of the internal network. As reported by the company, the credentials were then misused to create fake withdrawal requests. “The attacker then used these credentials to send fraudulent withdrawal commands to the wallet system,” Bitget said in its account of the breach. 

According to the firm, there was no loss of any private keys and that their cold wallets were not affected. Bitget's incident report outlines the attack that targeted the firm's backend wallet systems and input fake transaction data into its authorisation system. The investigation is still being assisted by Mandiant and SlowMist, the blockchain security firm. According to Bitget, the company's own security team found the way the hack took place and fixed the weakness that enabled the hack.

Bitcoin was the first coin that was withdrawn from Bitget's withdrawal pause. Bitget resumed withdrawals for BTC on the Bitcoin network at 08:00 UTC on September 28, four days after the start of the pause. Next up in the schedule is Ether. ETH withdrawals will resume on September 29 at 08:00 UTC on Ethereum, BNB Smart Chain, Arbitrum, Base, and Optimism chains. USDT withdrawals will resume on September 30 at 08:00 UTC on Ethereum, BNB Smart Chain, Solana, and Tron.