Crypto exchange Bitget announcement: the vulnerability involved in the hacking incident has been patched, and withdrawals will be restored in four batches. Bitcoin will be the first to reopen at 16:00 Taiwan time on September 28, followed by Ethereum and USDT on the 29th and 30th. Other tokens, fiat currencies, and P2P will have to wait until October 2. Bitget said user balances will not be affected, and losses of about $387.5 million will be covered by its protection fund. (Background summary: the stolen amount was raised to $388 million, and Zcash and TRON chain assets were also added.) (Additional context: Bitget hacking—$350 million suspect tracked: stolen XRP flowed into the “North Korean hacker Lazarus” vault.) Key summary Bitget BTC withdrawals resume first at 16:00 Taiwan time, Sept. 28; ETH opens on Sept. 29 and USDT on Sept. 30; other tokens and so on open on Oct. 2 Loss revised up to $387.5 million; protection fund over $464 million Crypto exchange Bitget issued an announcement early on Sept. 26 Taiwan time stating that the vulnerability involved in the incident has been confirmed and patched. Withdrawals that were paused will be restored in four batches: Bitcoin first, scheduled for 4:00 p.m. Taiwan time on Sept. 28 (Monday). Other tokens, fiat currencies, and P2P come in the last batch, to resume at the same time on Oct. 2 (Friday). In the announcement, Bitget said the pause on withdrawals is to complete the final round of security verification and is not related to whether users’ assets are sufficient. Users’ account balances will not be affected. Losses caused by the incident will be covered by Bitget’s protection fund, and trading and deposits are currently operating as usual. The announcement also said the incident has been contained, and there will be no further unauthorized transfers. Bitget said that Google’s cybersecurity firm Mandiant and SlowMist are continuing to assist with the investigation. Bitcoin opens first, and XRP is in the last batch Official announcement times are marked in UTC; after converting to Taiwan time, the four-batch schedule is as follows: Sept. 28 16:00: BTC (Bitcoin network) Sept. 29 16:00: ETH (Ethereum, BSC, Arbitrum, Base, Optimism) Sept. 30 16:00: USDT (Ethereum, BSC, Solana, Tron) Oct. 2 16:00: Other tokens, fiat currencies, and P2P The time of the incident announced by Bitget is 2:31 a.m. Taiwan time on Sept. 25. Based on this, BTC withdrawals take about 3.5 days from the pause to the resumption, and full service restoration takes about 7.5 days. XRP is not included in the first three batches, so it must wait until Oct. 2 together with other tokens. After a live stream on Sept. 25, CEO Gracy Chen posted a summary of key points; at the time, he noted that XRP is the largest asset loss on a single chain in this incident. Bitget said the batch order is consistent for all users, with no priority list. Users do not need to take any action in advance; whether each coin can be withdrawn will be shown directly on the platform. Gracy Chen will hold an AMA livestream at 3:30 p.m. Taiwan time on Sept. 28 to explain the incident and the recovery progress, with the event scheduled for half an hour before BTC withdrawals are opened. Before this schedule announcement, on Sept. 25 Gracy Chen said in a post that the company would announce the specific timing only after confirming it, and would not promise timelines it couldn’t meet. In another announcement posted the same day, Bitget said it would publish the withdrawal schedule by noon on Sept. 26 Taiwan time. The actual schedule announcement was sent at 3:55 a.m. on Sept. 26—about eight hours earlier than its own deadline. After the loss amount was revised upward, the protection fund buffer narrowed. On Sept. 25, Bitget updated the tracked on-chain assets transferred to the attacker’s address to about $387.5 million, which is about $35.9 million more than the initially estimated $351.6 million (Bitget incident update). The difference comes from Zcash and TRON chain assets that had not been counted earlier. Affected tokens include XRP, ETH, USDT, ZEC, USDC, BNB, AVAX, and TRX, among others. According to Gracy Chen’s remarks on Sept. 25, the protection fund exceeds $464 million, with all funds placed in publicly verifiable wallet addresses. Bitget also has more than $1 billion in its own assets. Using the revised amount, the protection fund has about $76.5 million more than the losses. With the initial estimate, the gap between the two was about $112 million, meaning the buffer was reduced by roughly 30%. Bitget also launched a bounty program to help freeze or recover stolen assets for individuals or institutions. Participants can receive 5% of the bounty amount, and the primary cooperation channel is Bybit’s LazarusBounty. The announcement noted that some stolen assets have already been frozen with assistance from industry partners. FAQ When will Bitget resume withdrawals? Bitget will restore withdrawals in four batches: BTC first at 16:00 on Sept. 28 Taiwan time; Ethereum on Sept. 29; USDT on Sept. 30; and other tokens, fiat, and P2P at 16:00 on Oct. 2. Will users’ assets be affected after the Bitget hack? Bitget said users’ account balances will not be affected, and losses of about $387.5 million will be covered by the protection fund. CEO Gracy Chen said the protection fund exceeds $464 million, and Bitget also has more than $1 billion in its own assets. Related reports Bitget hack: $356 million “100 million XRP stolen,” CEO: highly suspicious of North Korean hackers—definitely not the next FTX North Korean hacker Lazarus Selling $30 million in BTC on Hyperliquid—got caught? Tricked in a “fake recruitment” interview, stealing $10.7 million "Bitget to restore withdrawals in four batches! BTC opens first on 9/28" This article was first published on Dongqu BlockTempo (Dongqu—most influential blockchain news media).