CoinTrust

Bitget Resumes Bitcoin Withdrawals After $387.5M Breach

bitget web3 trading

Bitget has resumed Bitcoin withdrawals after transferring 3,630 BTC, worth about $300 million, from cold storage to hot wallets following a security breach that resulted in an estimated $387.5 million loss.

The exchange restarted BTC withdrawals at 4 p.m. and began processing transactions after moving funds from its cold wallets, including assets held in its risk protection fund. More than 6,000 withdrawal requests were processed during the first hour, representing about 2,700 BTC valued at roughly $220 million. Initial on-chain confirmations indicated that the resumed withdrawals were being completed.

Risk Protection Fund Covers Losses

The incident marked Bitget’s first major security incident in eight years and resulted in a substantial drawdown from its $464 million risk protection fund. The fund was used to absorb the $387.5 million loss associated with the breach.

Bitget said it plans to replenish the protection fund to at least $300 million using proprietary capital within seven days. The move is intended to restore a significant portion of the reserves that were used to cover the losses and support the exchange’s ability to meet customer obligations.

The exchange’s risk protection fund absorbed the reported $387.5 million loss, while Bitget committed to restoring the fund to at least $300 million within seven days using its own capital.

The breach was attributed to a vulnerability involving a third-party security product. Attackers reportedly exploited the flaw to obtain credentials providing access to the exchange’s internal network. Those credentials were then used to generate forged withdrawal commands that bypassed existing controls.

According to the reported findings, the incident did not result from internal collusion. Bitget said the relevant vulnerabilities had been patched, indicating that remediation work had been completed before withdrawals were fully restored.


Large-Scale Bitcoin Transfers Resume

The movement of 3,630 BTC into hot wallets represented a major operational step in restoring withdrawal liquidity. Moving assets from cold storage allowed the exchange to make funds available for customer transactions while the platform continued responding to the security incident.


The processing of more than 6,000 withdrawals in the first hour also provided an early indication that Bitget had restored a substantial portion of its Bitcoin withdrawal infrastructure. The approximately 2,700 BTC processed during that period accounted for a significant share of the Bitcoin transferred into operational wallets.

The incident highlights the operational risks associated with third-party security infrastructure at centralized cryptocurrency exchanges. Although exchanges typically separate customer assets from operational systems and apply multiple withdrawal controls, vulnerabilities affecting connected security products can create additional attack surfaces.

Bitcoin Market Faces Technical Pressure

Bitcoin was trading at $82,843.89 on the four-hour chart, with technical indicators showing a bearish structure. The 50-period exponential moving average stood at $83,459.02, creating an immediate resistance level above the market price, while the 200-period EMA was positioned at $78,829.52 and represented a deeper support area.

The MACD indicator had formed a death cross, with the reading at -128.94, pointing to continued downside pressure. The relative strength index stood at 37.36, placing momentum in a relatively weak but not deeply oversold area.

Bitcoin was also testing the lower Bollinger Band near $83,040.99. Such positioning can indicate elevated short-term volatility and may allow for a measured rebound before the broader trend becomes clearer.

The combination of a bearish EMA structure and negative MACD momentum suggests that Bitcoin remains under technical pressure, while the RSI and lower Bollinger Band indicate that short-term stabilization remains possible.

Bitget’s withdrawal resumption and the rapid processing of thousands of transactions mark the latest operational phase following the breach, while the planned replenishment of its protection fund will remain a key part of its post-incident response.4

Exit mobile version