Bitget's Withdrawal Restart Is a Five Day Calendar: Trading a Scheduled Collateral Release

Bitget restarted bitcoin withdrawals at 08:00 UTC on September 28, four days after an attacker moved roughly $387.5 million off the exchange. The restart is not a single switch being flipped. It is a published, asset by asset calendar that runs until October 2, with ether on September 29, USDT on September 30, and everything else including fiat and P2P at the end (The Block). For a trader who holds margin on the venue, or who prices basis against it, that calendar is the tradeable object, not the hack itself.

Scheduled collateral releases are rare. Most exchange incidents end with an unannounced resumption, and the flow arrives as a surprise. Here the sequence is public four days in advance, which means the flow is predictable in timing even if it is unpredictable in size.

The Bitget Withdrawal Restart Calendar, and Why the Ordering Matters

The published sequence, per The Block, runs as follows. Bitcoin on the Bitcoin network opened at 08:00 UTC on September 28. Ether across Ethereum, BSC, Arbitrum, Base and Optimism opens at 08:00 UTC on September 29. USDT across Ethereum, BSC, Solana and Tron opens at 08:00 UTC on September 30. All remaining assets, plus fiat and peer to peer, open on October 2.

The ordering is the interesting part. Bitcoin went first, and bitcoin is the asset least likely to be someone's perp margin on a venue like this. USDT, which is the actual collateral behind most of the open perpetual positions on the exchange, comes third. That gap between September 28 and September 30 is a window in which a trader can exit bitcoin exposure but cannot yet move the stablecoin that backs their margin.

That asymmetry tends to produce a specific behavior: positions get flattened before collateral gets moved, because flattening is possible immediately and moving is not. Watch for the reduction in Bitget open interest to lead the stablecoin outflow by about 48 hours rather than coinciding with it.

Reading Cross Venue Funding Rate Comparison During the Release

When collateral is trapped on one venue and mobile on others, the funding rate on the trapped venue decouples. Traders who cannot move margin off Bitget can still trade with it, and traders who can move margin elsewhere have no reason to arbitrage a venue they are trying to exit. The result is a persistent spread rather than the usual convergence.

A cross venue funding rate comparison across Bitget, Binance and Hyperliquid through October 2 is the cleanest way to see whether the release is orderly. If Bitget funding converges back toward the wider market as each asset unlocks, the collateral is moving and confidence is returning. If it stays dislocated after October 2, the remaining balances are either stuck or deliberately parked.

The same logic applies to basis. A venue whose users cannot withdraw will price perps against spot differently from a venue whose users can, and that difference closes on a schedule you can now write down in advance.

The Loss Figure Moved From $351.6 Million to $387.5 Million

On September 25, chief executive Gracy Chen put the loss at $351.6 million and described the mechanism precisely: the attacker compromised a backend system inside the wallet infrastructure, spoofed transaction data, and pushed the fabricated transfers through the exchange's own authorization process. Private key compromise was ruled out (CoinDesk).

By September 28 the figure being reported had risen to $387.5 million (BleepingComputer), a revision of roughly 10% over three days. Loss estimates that drift upward during an incident are normal, because on-chain tracing finds additional outbound paths after the initial accounting. It is still worth noting, because the size of the hole determines how much of the protection fund gets consumed.

Bitget has said the User Protection Fund holds over $464 million and that 5,500 BTC has been allocated to cover the loss in full (CoinDesk, The Block). At current prices that allocation is comfortably larger than the revised loss, which is why the restart could be scheduled at all.

Some of the Stolen Assets Are Already Beyond Recall

The attacker moved about $83 million of stolen XRP through paths that Ripple's freeze controls could not reach (CoinDesk). Affected networks in the incident included Ethereum, XRP Ledger, Arbitrum, Avalanche, Optimism, BSC and Base, with ether, USDT, USDC, AVAX and BNB among the assets taken.

Bitget has engaged Mandiant and SlowMist for the investigation and posted a 5% bounty for information leading to frozen or recovered funds. Chen has attributed the attack to North Korea linked actors, citing on-chain analysis and IP behavior patterns.

Recovery matters less to a trader than the protection fund does. The fund is what makes the balances whole; recovery only determines who ultimately absorbs the cost. The relevant question through October 2 is whether the withdrawal queue clears on the published timetable, not whether the attacker gets caught.

What to Watch Between Now and October 2

Three things carry signal. First, whether each unlock actually opens at 08:00 UTC on the stated day. A slipped window is the single strongest tell that the balance sheet is tighter than stated. Second, the shape of the outflow on the first hour of each unlock, because a venue that survives the first hour usually survives the day. Third, whether displaced collateral shows up as deposits elsewhere, particularly on perp DEXs where wallet level attribution makes the arrival visible rather than inferred.

That last point is where on-chain flow beats exchange reporting. A user leaving a centralized venue is invisible on the way out and visible on the way in, and the wallets that receive large stablecoin transfers over the next four days are the ones that were trapped this week. Buildix tracks that arrival side across Hyperliquid at the wallet level on buildix.trade/wallet, alongside funding and open interest across 530 plus pairs in the screener.

A published restart calendar is an unusual gift. It converts a credit event, which is normally impossible to time, into four dated windows with known asset scopes. The traders who get paid on this are not the ones with a view on whether Bitget survives. They are the ones who noted that USDT unlocks two days after bitcoin does, and positioned for the gap.