Bitget has resumed Bitcoin withdrawals after transferring 3,630 BTC — worth approximately $300 million — from cold storage into hot wallets, following a security breach that resulted in an estimated loss of $387.5 million.

The exchange restarted BTC withdrawals at 4 p.m. and began processing transactions after moving funds out of its cold wallets, including assets held in its risk protection fund. More than 6,000 withdrawal requests were processed within the first hour, representing about 2,700 BTC valued at roughly $220 million, and initial on-chain confirmations indicated the withdrawals were being completed.

The speed of that resumption is a detail users and counterparties typically weigh after an exchange security incident, since the ability to process withdrawals on demand is a direct measure of an exchange's liquidity and operational control.

Risk Protection Fund Covers Losses

The incident marked Bitget's first major security incident in eight years and triggered a substantial drawdown from its $464 million risk protection fund, which absorbed the $387.5 million loss associated with the breach. Based on the reported figures, absorbing the loss would leave roughly $76.5 million of the fund's prior balance, which frames the scale of the planned rebuild.

Bitget said it plans to replenish the protection fund to at least $300 million within seven days using proprietary capital. The company said the move is intended to restore a significant portion of the reserves used to cover the losses and to support the exchange's ability to meet customer obligations. Reserve funds of this type are a common mechanism among centralized exchanges for covering client losses from security events, and their stated size is often read as a gauge of an exchange's capacity to make customers whole.

According to the reported findings, the breach was attributed to a vulnerability involving a third-party security product. Attackers reportedly exploited the flaw to obtain credentials providing access to the exchange's internal network, and those credentials were then used to generate forged withdrawal commands that bypassed existing controls. Bitget said the incident did not result from internal collusion and that the relevant vulnerabilities had been patched, with remediation work completed before withdrawals were fully restored.

The company addressed the incident publicly on X, including a live stream on the day of the event:

Live about Bitget Hot Wallet Incident on September 24, 2026 — Bitget (@bitget) September 24, 2026

Large-Scale Bitcoin Transfers Resume

The movement of 3,630 BTC into hot wallets represented a major operational step in restoring withdrawal liquidity. Hot wallets maintain an internet connection to serve customer transactions, while cold storage keeps private keys offline — a distinction central to exchange security design, since offline reserves are insulated from network-based attacks but cannot process withdrawals directly.

Moving assets from cold storage allowed the exchange to make funds available for customer transactions while the platform continued responding to the security incident.

In a follow-up post, Bitget confirmed that the reopening extended to an additional network and directed users to remarks from its chief executive:

Please note that BTC withdrawal on BSC Network is also now open. Earlier today, our CEO Gracy Chen addressed the incident and community inquiries during a live AMA. Watch the replay here: The investigation found that the attacker exploited a… — Bitget (@bitget) September 28, 2026

The processing of more than 6,000 withdrawals in the first hour provided an early indication that Bitget had restored a substantial portion of its Bitcoin withdrawal infrastructure. The approximately 2,700 BTC processed during that period accounted for a significant share of the Bitcoin transferred into operational wallets.

The incident highlights the operational risks associated with third-party security infrastructure at centralized cryptocurrency exchanges. Although exchanges typically separate customer assets from operational systems and apply multiple withdrawal controls, vulnerabilities affecting connected security products can create additional attack surfaces.

Bitcoin Market Faces Technical Pressure

Bitcoin was trading at $82,843.89 on the four-hour chart with technical indicators showing a bearish structure. The 50-period exponential moving average stood at $83,459.02, creating an immediate resistance level above the market price, while the 200-period EMA was positioned at $78,829.52 and represented a deeper support area.

The MACD indicator had formed a death cross, with the reading at -128.94, pointing to continued downside pressure. The relative strength index stood at 37.36, placing momentum in a relatively weak but not deeply oversold area. Bitcoin was also testing the lower Bollinger Band near $83,040.99.

Such positioning can indicate elevated short-term volatility and may allow for a measured rebound before the broader trend becomes clearer. The combination of a bearish EMA structure and negative MACD momentum suggests Bitcoin remains under technical pressure, while the RSI and lower Bollinger Band indicate that short-term stabilization remains possible.

Bitget's withdrawal resumption and the rapid processing of thousands of transactions mark the latest operational phase following the breach, while the seven-day window it has set for replenishing the protection fund offers a concrete timeline against which the exchange's recovery can be measured.

Source: CoinTrust