Bitcoin withdrawals resumed Monday, with the rest of the exchange's assets scheduled to follow by Friday. A 5% bounty on recovered funds could be worth up to about $19 million.
Bitget began letting customers pull funds again on Monday, opening a four-day sequence to restore withdrawals after a hack that the exchange now puts at about $387.5 million.
Bitcoin withdrawals came first, restarting at 08:00 UTC on Sept. 28. Ether follows on Sept. 29 and Tether's USDT on Sept. 30. All remaining tokens, fiat and peer-to-peer transfers are scheduled to return on Oct. 2, which the exchange has set as its target for full restoration. Bitget says customer funds are "safe and secure."
A larger number, and an explanation
The loss estimate has risen from $351.6 million, an increase of $35.9 million, or about 10%. Bitget attributes the change to "additional assets identified during transaction tracing rather than a second wave of unauthorized transfers." In other words, the exchange says it has found more of what was already taken, not lost more.
Investigators are still working the case. Bitget has brought in Mandiant and SlowMist as independent investigators, and suspicion has fallen on North Korean state-linked hackers, a pattern seen in several of the largest exchange breaches in recent years, though no attribution has been established in court.
The bounty math
The exchange has launched a recovery program that pays 5% of any funds returned. If the full $387.5 million were recovered, that would amount to roughly $19.4 million. In practice, recoveries in large hacks tend to be partial, and some of the stolen assets have already moved through the THORChain protocol into bitcoin, which makes them harder to trace and claw back.
Why the order matters
The sequence reflects liquidity and risk. Bitcoin, the most liquid asset on the platform, is the easiest to honor at scale. Stablecoins such as USDT have more direct paths to freezing and recovery through their issuers, which may explain why they come later in the schedule than a simple liquidity ranking would suggest. Leaving fiat and peer-to-peer rails for last gives the exchange time to complete compliance checks on the channels most exposed to fraud.
What to watch
The key test is whether each stage opens on time and whether withdrawal requests stay orderly. A rush of outflows once ether and USDT reopen would show that customers are using the restart to leave. Steady balances would suggest the exchange has held on to user confidence despite the size of the loss. The Oct. 2 date is the benchmark: a delay past it would raise new questions about the exchange's reserves.