Bitget Customers Withdraw Over 4,000 Bitcoins in One Hour Following $388M Hack
Key Takeaways
- •Customers withdrew 4,098 bitcoins across 9,585 orders, valued at more than $334 million, in the first hour after Bitget resumed withdrawals following the security breach.
- •Hackers stole $388 million from Bitget's internet-connected hot wallets the previous week using a method the exchange said was highly consistent with known patterns of North Korean hacker organizations.
- •No cold storage funds were compromised, as attackers instead exploited vulnerabilities in third-party products to steal internal credentials and issue fraudulent withdrawal commands that bypassed risk controls.
- •Bitget is replenishing its customer protection fund with its own money after the reserve fell below $200 million, down from $464 million before the hack.
- •The Seychelles-based exchange, ranked sixth-largest by trading volume with a customer base mostly in Asia, described the incident as its first security event of this nature in eight years and said it remains contained.
Investors withdrew more than 4,000 bitcoins, worth over $334 million at today's prices, within a single hour after Bitget resumed customer withdrawals, according to the exchange's chief executive.
Bitget CEO Gracy Chen told Bloomberg Television on Tuesday that withdrawals from the exchange had stabilized following the immediate burst of bitcoin transactions. Hackers had targeted the hot wallets of the Victoria, Seychelles-based exchange the previous week, making off with $388 million in cryptocurrency.
"The withdrawals actually stabilized a lot today," Chen said. "Those hundreds of millions [in bitcoin withdrawals] actually most of them happen on the first hour of the withdrawal restart."
In a Monday post on X, Chen said the exchange processed 9,585 orders totaling 4,098 bitcoins. Customers are being allowed to withdraw funds in phases — a standard post-incident measure that restores access gradually while demand built up during a freeze clears.
Bitget froze withdrawals after blockchain experts flagged that money was leaving the exchange. The company later said the attack method used in the incident was "highly consistent with known patterns of North Korean hacker organizations."
Chen said no cold storage funds were touched. Instead, attackers had "exploited vulnerabilities from third-party products to steal internal credentials, then used those credentials to send fraudulent withdrawal commands that bypassed our risk controls." The distinction matters: hot wallets are internet-connected accounts exchanges use for day-to-day withdrawals, while cold storage keeps funds offline and beyond the reach of remote attackers.
She added that Bitget was using its own money to top up its protection fund after the reserve shrank in size. Bloomberg reported the fund had fallen below $200 million, down from $464 million before the hack. Protection funds are some exchanges maintain to cover customer losses in the event of a breach.
Bitget described the episode as its first "security incident of this nature in eight years."
"The incident remains contained, and no further unauthorized transfers are possible," the exchange said in a notice.
According to CoinGecko, Bitget is the sixth-largest exchange by trading volume, processing $811 million in transactions over the past 24 hours. The exchange's customers are mostly based in Asia.
Attackers linked to the North Korean government have long targeted cryptocurrency exchanges and rank among the most sophisticated cybercriminal groups; researchers estimate such groups have stolen billions of dollars from crypto platforms over the past decade. With withdrawals still proceeding in phases and the protection fund being replenished from Bitget's own money, how the remaining phases conclude and how quickly the reserve recovers are the concrete markers to watch as the aftermath unfolds.
This article is based on reporting by Mathew Di Salvo and first appeared on Bitcoin Magazine.
