Bitget to End Services for Select Users in One-Off Move
Key Takeaways
- •Bitget will discontinue services for a specific group of users as a one-off action, while its platform continues operating normally and affected users' funds are safe.
- •Affected users will receive direct notifications through email, in-app messages, or push notifications detailing deadlines and procedures for withdrawing their funds.
- •The announcement follows a September 24 breach that caused $387.5 million in losses, after attackers exploited a zero-day vulnerability in third-party security products to access wallets across 11 blockchains and steal nearly 103 million XRP.
- •Bitget responded to the hack by suspending withdrawals, launching a Recovery Bounty Program offering 5% of any frozen or recovered funds, and committing to reimburse users through its User Protection Fund, which held over $464 million before the incident.
- •Only around $840,000, or 0.2% of the stolen assets, had been publicly frozen by September 29, and the exchange's BGB token has declined 5.5% to $1.89 since the event.
Bitget will discontinue services for a subset of its users as part of a one-off measure, the exchange said Saturday in a post on X.
The Seychelles-headquartered company said its platform would continue operating normally and assured affected users that their funds remain safe, while pointing them to an online resource for verifying their assets.
Users subject to the changes will receive direct communications by email, in-app messages and/or push notifications explaining the next steps, relevant deadlines and arrangements for withdrawing their funds, according to the exchange. For those affected, the deadlines and withdrawal arrangements set out in those messages are the key details to watch, as they determine how and when funds can be moved off the platform.
The announcement arrives just weeks after a $387.5 million hack that ranks among the biggest security breaches in centralized exchange history. It also comes as the platform faces increasing pressure to meet stricter regulatory requirements worldwide, part of a broader environment in which exchanges with global user bases have been adjusting service availability for particular user groups as oversight tightens.
The September hack
Bitget suffered a $387.5 million security breach on September 24 after attackers exploited a zero-day flaw — a previously unknown vulnerability for which no patch was yet available — in third-party security products to access the exchange's infrastructure. The hackers drained hot and warm wallets, the online wallets exchanges use to process day-to-day withdrawals, across 11 blockchains, including Ethereum and the XRP Ledger, stealing nearly 103 million XRP.
According to reports, the attackers gained initial access through security appliances supplied by an external vendor, then used privileged access to send forged withdrawal commands through Bitget's wallet systems — underscoring how vulnerabilities in third-party products can expose crypto platforms to broader security risks.
In response, Bitget temporarily suspended withdrawals and introduced a Recovery Bounty Program on September 25, offering 5% of any funds directly frozen or recovered, an incentive designed to enlist outside investigators and industry peers in tracing stolen assets. The exchange also pledged to make users whole through its User Protection Fund, a reserve maintained to cover user losses, which held more than $464 million until the incident.
Withdrawal services resumed gradually from September 28 and were fully restored by October 2. Despite these measures, only around $840,000 — equivalent to 0.2% of the stolen assets — had been publicly frozen by September 29. Further public updates on frozen or recovered funds would offer the clearest signal of how the Recovery Bounty Program is progressing since that disclosure.
Meanwhile, the exchange's BGB token has declined by 5.5% since the event, falling from above $2 to $1.89, according to CoinMarketCap data.
