Bitget is moving into the second day of its phased withdrawal recovery after reopening Bitcoin withdrawals following the $387.5 million security breach that disrupted the exchange last week.
The next stage centers on Ethereum. Bitget’s published recovery schedule set ETH withdrawals to resume at 08:00 UTC on September 29 across Ethereum, BNB Smart Chain, Arbitrum, Base and Optimism. USDT is scheduled to follow on September 30 across Ethereum, BSC, Solana and Tron, with other cryptocurrencies, fiat withdrawals and peer-to-peer services due to return on October 2.
The timetable puts Bitget into a more demanding part of the recovery. Bitcoin was the first major test on September 28, when the exchange reopened Bitcoin withdrawals after four days of restrictions. Ethereum expands that test across several networks simultaneously and introduces a much broader set of user balances and wallet infrastructure.
Bitcoin Withdrawals Put the Recovery Under Real Load
The first stage generated substantial activity almost immediately.
Bitget CEO Gracy Chen said the exchange had processed 9,585 Bitcoin withdrawal orders totaling 4,098.036 BTC by 17:00 UTC+8 on September 28. The figure matters because the withdrawal restart was not merely a limited technical test. Thousands of customers were able to put the restored infrastructure under real operational load within hours.
Bitget has said user account balances remain unaffected and that the withdrawal suspension was introduced as a security precaution rather than because customer assets were unavailable. Deposits and trading continued while withdrawals were disabled.
The exchange says the incident began on September 24 when unauthorized transfers were detected from part of its hot and warm wallet infrastructure. The estimated value of affected assets was initially placed at $351.6 million before being revised to approximately $387.5 million after additional Zcash and Tron transactions were incorporated into the accounting.
Bitget says investigators traced the attack to a vulnerability in a third-party security product that allowed the attacker to obtain internal credentials and generate fraudulent withdrawal instructions. According to the exchange, private keys were not compromised and cold wallets remained unaffected.
That distinction is important because the attack appears to have targeted the infrastructure deciding whether a withdrawal was legitimate rather than stealing the cryptographic keys controlling Bitget’s entire wallet system. It is a different failure mode from incidents involving directly compromised signing credentials, such as the recent D’CENT XRP wallet drain.
The Protection Fund Is Now Part of the Withdrawal Story
Bitget’s recovery is also becoming unusually visible on-chain because its User Protection Fund is denominated in Bitcoin.
The fund held 5,500 BTC before the incident. On-chain monitoring cited by Bitget News showed that 2,042.28 BTC had been transferred from Protection Fund addresses toward hot-wallet infrastructure as Bitcoin withdrawals restarted.
That movement should not be confused with customer withdrawals. Transferring Bitcoin from one Bitget-controlled address to another simply places liquidity where the exchange can use it. The distinction is similar to other large on-chain wallet movements, where the blockchain proves that assets changed addresses but does not, by itself, establish the economic purpose behind the transfer.
Bitget has said its Protection Fund covers the financial impact of the breach. The fund was valued above $464 million around the time the incident was disclosed, making the $387.5 million loss unusually large relative to the size of the backstop.
Chen has also said Bitget intends to replenish the fund to at least its $300 million baseline after deployment. That makes fund replenishment, alongside withdrawal volumes and reserve data, one of the clearest measurable indicators of how the exchange absorbs the breach financially.
Recovery of the Stolen Assets Is a Separate Battle
Restoring customer withdrawals does not mean the stolen cryptocurrency has been recovered.
Some of the attacker’s assets have continued moving. Around 103 million XRP was taken during the breach, and more than half of that position had already left the original receiving wallets by September 26. Dave Finances previously tracked roughly $83 million in stolen XRP moving from three holding wallets.
Other funds have followed more complicated routes. Blockchain investigators have traced part of the stolen portfolio through several networks and decentralized conversion mechanisms, including a route that ultimately placed Bitcoin into Wasabi CoinJoin.
Those movements illustrate why recovery varies by asset. Stablecoin issuers such as Circle and Tether can blacklist certain addresses, while native cryptocurrencies such as BTC, ETH and XRP do not have an issuer that can simply disable coins held in a self-custodied wallet. Recent USDC blacklist activity shows how powerful issuer controls can be when stolen or disputed funds remain in centrally administered tokens.
Bitget has also launched a recovery bounty offering 5% of assets successfully frozen or recovered through qualifying assistance.
Ethereum Is a More Revealing Test Than Bitcoin
The second stage may tell investors more about the quality of the recovery than the first.
Bitcoin gave Bitget one relatively straightforward asset and a limited number of withdrawal routes to restart. ETH is different. The scheduled reopening spans Ethereum itself plus BSC, Arbitrum, Base and Optimism.
That means more wallet infrastructure, more network-specific transaction handling and more opportunities for operational problems to surface.
The important question is therefore not simply whether an ETH withdrawal button becomes available. What matters is whether withdrawals clear at normal speeds across the supported networks, whether users report meaningful delays, and whether Bitget needs to pause or modify any part of the rollout.
This is where crypto incidents become operational rather than purely financial. A vulnerability can be patched relatively quickly; proving that a repaired system behaves normally under live customer demand takes longer. The recent Payy bridge exploit showed how a security failure can spread into a broader service outage when critical transaction infrastructure has to be shut down.
USDT Could Be the Bigger Liquidity Test
Ethereum is important, but September 30 could be even more revealing.
USDT is one of the main settlement assets used by active crypto traders. Reopening it across Ethereum, BSC, Solana and Tron gives customers a highly liquid dollar-denominated route out of the exchange without requiring them to withdraw volatile assets first.
That could make the USDT stage a cleaner signal of customer behavior after the breach.
A user withdrawing BTC may simply be restructuring a crypto portfolio. Someone withdrawing USDT is moving dollar-linked liquidity that can be sent rapidly to another exchange, wallet or trading venue. If there is significant residual nervousness among Bitget customers, stablecoin flows may expose it more clearly.
That does not mean large withdrawals would automatically signal a solvency problem. After several days without withdrawal access, some pent-up demand is inevitable. Users may also be moving assets simply because they had been unable to do so since September 24.
The better signal will be persistence. A sharp initial wave followed by normalization would tell a very different story from sustained outflows across BTC, ETH and USDT while reserve ratios weaken.
The Real Recovery Test Runs Through October 2
Bitget has already cleared the first hurdle: Bitcoin withdrawals returned and processed thousands of requests without another publicly disclosed security incident.
But this is still the early part of the recovery.
Investors now have several measurable things to watch: whether ETH withdrawals operate normally across all scheduled networks, whether the September 30 USDT reopening generates unusually persistent outflows, whether other tokens and fiat services return on October 2 as planned, and how quickly the Protection Fund is rebuilt.
Proof-of-reserves data will matter as well. The Protection Fund and ordinary customer reserves serve different purposes, and one of the most important questions after a loss of this size is whether Bitget can absorb the financial damage without materially weakening the assets backing customer balances.
The on-chain component makes this unusually transparent. Protection Fund transfers, hot-wallet balances and outbound transactions can all be monitored in real time. But that transparency also creates room for bad interpretation: internal wallet transfers can be mistaken for customer exits, and exchange-wallet trackers can shift as addresses are reorganized.
For now, the stronger evidence comes from combining those blockchain movements with actual processed withdrawal figures and future reserve disclosures.
Bitget is no longer trying to prove that the attacker has been stopped. It is trying to prove that the exchange can operate normally after absorbing a $387.5 million security loss.
Bitcoin was the first test. Ethereum broadens it. USDT may reveal the real liquidity response. By October 2, investors should have a much clearer picture of whether Bitget’s phased reopening was simply a technical recovery plan or a successful stress test of the exchange’s financial and operational defenses.
Shane Neagle is a financial markets analyst and digital assets journalist specializing in cryptocurrencies, memecoins, prediction markets, and blockchain-based financial systems. His work focuses on market structure, incentive design, liquidity dynamics, and how speculative behavior emerges across decentralized platforms.
He closely covers emerging crypto narratives, including memecoin ecosystems, on-chain activity, and the role of prediction markets in pricing political, economic, and technological outcomes. His analysis examines how capital flows, trader psychology, and platform design interact to create rapid market cycles across Web3 environments.
Alongside digital assets, Shane follows broader fintech and online trading developments, particularly where traditional financial infrastructure intersects with blockchain technology. His research-driven approach emphasizes understanding why markets behave the way they do, rather than short-term price movements, helping readers navigate fast-evolving crypto and speculative markets with clearer context.