Updated October 6, 2026 (KST). Bitget reports an approximately $388 million impact from the September 24 exchange-wallet incident. Bitget announced that it completed the phased withdrawal, fiat and C2C restoration on October 2 at 08:00 UTC (17:00 KST). This company announcement is not an account-by-account availability guarantee or confirmation that all affected assets have been recovered. October 2 restoration announcement.
What happened, and what is confirmed?
Bitget’s updated timeline distinguishes the first unauthorized transfers at 18:31 UTC on September 24 (03:31 KST September 25) from detection of a reconciliation discrepancy at 19:05 UTC (04:05 KST September 25), when risk controls blocked withdrawals. The company says the incident was limited to a portion of its hot and warm exchange wallets, while its cold wallets were not affected. It suspended withdrawals as a precaution and said deposits and trading remained available. These are Bitget’s reported findings, not an independent audit of every wallet or account. See the initial security notice.
On September 25, Bitget raised its estimate from roughly $351.6 million to $387.5 million after adding assets on Zcash and TRON to its tracing and classification. It identified Ethereum/EVM networks, XRP Ledger, Zcash and TRON in the incident and said an investigation and recovery effort were continuing with Mandiant and SlowMist. Bitget reports remediation and no further unauthorized transfers identified after containment. On September 30 at 05:20 UTC (14:20 KST), Bitget announced that Mandiant and SlowMist investigation reports were available. Bitget says both investigations identified compromised third-party security products that enabled unauthorized access to its exchange-wallet environment. This article has verified the report-release announcement, not independently audited the underlying forensic evidence. An exact recovered amount is not established by that announcement. See the report-release update. Read the September 25 investigation update.
Bitget says user account balances are unaffected and its User Protection Fund covers the financial impact of this platform-wide incident. That is the company’s assurance; it is not a promise that every separate account compromise, individual withdrawal problem, or future loss is automatically reimbursable. The ultimately recovered amount and any claim-specific compensation procedure remain matters to check against later disclosures; the availability of investigation reports does not itself establish completed recovery.
Withdrawal timetable: UTC and Korea time
The table retains the historical announced UTC/KST schedule. Bitget now reports that the rollout was completed. Check the exact asset, network and account status in the withdrawal screen; later maintenance or account restrictions can still apply. live official timetable.
| Scheduled start (UTC) | Korea time (KST) | Service and supported networks in the notice |
|---|---|---|
| September 28, 08:00 | September 28, 17:00 | BTC on Bitcoin — reopened |
| September 29, 08:00 | September 29, 17:00 | ETH on Ethereum, BSC, Arbitrum, Base, Optimism — reopened |
| September 30, 08:00 | September 30, 17:00 | USDT on Ethereum, BSC, Solana, Tron |
| October 2, 08:00 | October 2, 17:00 | Other tokens, fiat and P2P |
Bitget reports that its CEO AMA took place September 28 at 07:30 UTC (16:30 KST). Check the exact asset and network in your account before any transfer; the company says there is no separate priority withdrawal channel.
What should a Bitget user do now?
- Check the official status, not a forwarded screenshot. Open the Bitget app or type bitget.com yourself. Compare the announcement’s coin, network and time with the exact withdrawal form shown in your account. A platform-wide pause is different from an account-level freeze; our Bitget frozen-assets and disabled-account guide explains that distinction.
- Record your own account state. Note your available balance, open orders, withdrawal history, notifications and any exact error message. Keep timestamps in UTC where possible. A delayed withdrawal alone does not show that your personal account was accessed.
- Do not send a test transfer or pay a release fee to a stranger. If your coin or network is unavailable, wait for the in-platform status. Do not use social-media direct messages offering priority withdrawals, compensation registration or a “wallet migration.” Never disclose a password, 2FA code, API secret or recovery phrase.
- Escalate actual unauthorized account activity immediately. Unknown logins, trades, withdrawals, device changes or security alerts require a different response: use a trusted device, secure your email, change your Bitget login password, remove unfamiliar devices, review and revoke suspicious API keys, enable or reset 2FA through the official flow, and open a support ticket asking for account protection. Bitget’s account-compromise guide details these steps. Changing credentials is not presented here as a mandatory incident-wide instruction.
- Keep evidence and the support case number. For a suspected unauthorized transfer, save the affected asset, amount, timestamp, order or withdrawal ID, transaction hash if present, login alerts and redacted screenshots. Report through the official app or support center. Bitget says investigation and any recovery depend on the circumstances; completed blockchain transfers generally cannot simply be reversed.
How to avoid incident-related phishing
Security news often creates an opening for impersonators. Bitget’s anti-phishing notice advises users to verify the site, email or social-media account with its official verification tool and to use an anti-phishing code. Type the official domain or use your installed app instead of clicking an unsolicited “compensation” link. Bitget will not need your seed phrase or a remote-control session to restore a platform service.
What remains unconfirmed?
The investigation reports are now available according to Bitget’s September 30 announcement, but this article has not independently reviewed their full forensic evidence. The net amount ultimately recovered remains unconfirmed here. A scheduled time having passed is not proof of availability for a particular account or network. A protection-fund figure is not the same as a published claim-by-claim compensation procedure. Bitget says the separate non-custodial Bitget Wallet was not affected and that private-key compromise has been ruled out in its investigation to date. Those are attributed company findings, not a guarantee against unrelated account compromise or future loss.
Sources, update policy and disclosure
Fact check: October 1, 2026 (KST). Latest source: Bitget’s updated incident timeline and response. Historical notices and user-protection guidance: Bitget’s initial notice, revised incident and tracing update, withdrawal schedule, compromised-account instructions and phishing warning. Figures and service times can change. A material update should be added to this article rather than creating a duplicate incident page.
Disclosure and risk: BitQED is an independent affiliate-supported educational website, not Bitget or its customer support. We may receive a commission from eligible referral links elsewhere on this site; this article contains no registration call to action. No exchange, fund statement or checklist guarantees full recovery, immediate withdrawals or future security. Crypto custody, cybersecurity, market and regulatory risks remain. This article is information, not investment or legal advice.