Bitget reopened Ethereum withdrawals at 08:00 UTC on Tuesday, marking the second phase of restoring access after a breach that drained $387.5 million from the exchange. CEO Gracy Chen reported a net inflow of approximately 651 ETH in the first hour, interpreting this as user confidence, though independent verification remains pending. The attack exploited a vulnerability in a third-party security product to obtain internal credentials, allowing attackers to spoof transaction data and trigger fraudulent withdrawal commands without compromising private keys.
Recovery efforts have yielded minimal results, with only roughly $503,000 frozen by NEAR Intents out of more than $50 million intercepted in laundering flows. Cross-chain protocol THORChain declined to block attacker-linked addresses, citing neutrality policies. On-chain investigators Elliptic and ZachXBT linked the incident to North Korea’s state-affiliated hacking apparatus, noting similarities to previous operations like the Bybit breach. Bitget’s Protection Fund, initially holding over $464 million in Bitcoin, is being replenished to above $300 million from company capital to cover losses, while USDT withdrawals are scheduled to resume on September 30.
The Bitget incident underscores the critical vulnerability of centralized exchanges to supply chain attacks targeting operational infrastructure rather than cryptographic assets. By exploiting third-party credential weaknesses, attackers bypassed traditional cold storage protections, demonstrating that strong private-key hygiene does not guarantee platform solvency or asset safety. This distinction challenges the current market structure assumption that proof-of-reserve audits alone suffice for institutional trust, as they verify asset holdings but do not assess the integrity of backend authorization systems susceptible to social engineering or software vulnerabilities.
From a regulatory and compliance perspective, the limited recovery rate highlights systemic gaps in cross-chain interoperability protocols that prioritize censorship resistance over law enforcement cooperation. The refusal of major bridges like THORChain to freeze illicit flows complicates asset tracing and restitution, effectively shielding state-sponsored actors who leverage decentralized rails for money laundering. As Bitget navigates its phased withdrawal restoration, the focus shifts to whether its Protection Fund can maintain coverage amid Bitcoin price volatility and if upcoming forensic reports will reveal deeper structural flaws in exchange security standards.
