Bitget's withdrawal schedule is the test after its $387.5 million breach
BTC and ETH withdrawals have reopened. USDT and the remaining services follow in stages, turning each checkpoint into a test of whether users can actually regain access.
Article
A balance on an exchange screen is not the same as money you can move.
That difference matters after Bitget said attackers transferred about $387.5 million from its platform on September 24. The exchange paused withdrawals, said it fixed the vulnerability and is now reopening access in stages.
BTC withdrawals started processing on September 28, according to Bitget and reporting from The Block. Bitget then announced that ETH withdrawals opened on September 29 across Ethereum, BNB Chain, Arbitrum, Base and Optimism.
The next checkpoint is USDT, scheduled for September 30 at 4 a.m. Toronto time, or 08:00 UTC, on Ethereum, BNB Chain, Solana and Tron.
The schedule traders should watch
| Checkpoint | Assets and routes |
|---|---|
| September 28, 08:00 UTC | BTC on Bitcoin — opened |
| September 29, 08:00 UTC | ETH on Ethereum, BNB Chain, Arbitrum, Base and Optimism — opened |
| September 30, 08:00 UTC | USDT on Ethereum, BNB Chain, Solana and Tron — scheduled |
| October 2, 08:00 UTC | Remaining tokens, fiat withdrawals and P2P — scheduled |
These are Bitget’s scheduled times. They are not proof that every user’s withdrawal completed.
The useful signal at each step is simple: can ordinary users submit withdrawals on the named network, receive a transaction and see it settle without unusual delay?
What Bitget says happened
Bitget says the attacker exploited a third-party security product to obtain high-level internal credentials and send fraudulent withdrawal commands. The exchange says its private keys and cold wallets were not compromised.
It also says user balances are unaffected and its protection fund will cover the financial impact. Mandiant and SlowMist are assisting with the investigation, and Bitget has said a fuller security report will follow.
Those are important claims, but they still come from the exchange while the investigation is open.
Why proof of reserves is not the whole answer
Bitget published a proof-of-reserves snapshot before the breach. That type of report can show selected onchain assets and included customer balances at a point in time.
It does not prove that withdrawals work after an incident. It may not show every liability or offchain obligation either.
The reopening schedule gives users a more direct operational test. Each asset and network should move from a promise on a support page to an actual transaction that users can verify.
What to be careful about
- A partial opening can hide uneven access. One successful BTC withdrawal does not prove ETH, USDT, fiat or P2P is ready.
- The investigation can still change. The reported attack path is not a final forensic report.
- Coverage is an issuer claim. Saying a fund can absorb a loss is different from publishing a complete post-incident financial picture.
- Scammers use recovery events. Withdrawal updates should come from Bitget’s official app, website or support accounts, not links sent in replies or direct messages.
This is not a story about whether Bitget can publish a reassuring schedule. It is about whether the schedule turns back into reliable user access, one checkpoint at a time.
Sources and reporting notes
Checked September 30, 2026 before the scheduled USDT checkpoint. The timetable and balance statements come from Bitget’s withdrawal notice. Bitget’s separate ETH reopening notice says withdrawals opened on Ethereum, BNB Chain, Arbitrum, Base and Optimism. The loss estimate and investigation status come from its incident update. The reported BTC reopening and attack-path detail were cross-checked against The Block’s September 28 report.
We do not hold a Bitget account and did not submit a test withdrawal. Claims about unaffected balances, cold wallets and protection-fund coverage are attributed to Bitget. This is a counterparty-risk explainer, not a recommendation to deposit, withdraw or trade.