Bitcoin · BTC$81,750▼ 2.5%
Ethereum · ETH$2,435▼ 4.3%
USD / RUBRUB 83.9▼ 1.2%
EUR / RUBRUB 94.0▼ 1.0%
USD / UZSUZS 11,899.09▲ 0.0%
EUR / UZSUZS 13,298.42▼ 0.3%
Gold · PAXG$4,163▼ 0.9%
BTC dominance59.4%
All rates →
Crypto · Security

Bitget Hack: How Withdrawals Are Resuming and What It Means for Uzbekistan

Bitget reported the theft of about $387.5 million (≈4.58 trillion soums at the Central Bank of Uzbekistan rate as of 1 October 2026) from hot and warm wallets on 24 September 2026. The exchange restored BTC, ETH and USDT withdrawals on 28–30 September; on 2 October 2026 it announced that withdrawals of other tokens, fiat and C2C services had resumed and the phased plan was complete. Bitget is not in the NAPP license register (retrieved 1 October 2026) — we explain what this means for users from Uzbekistan.

· 8 min read · Sogdium Editorial
A row of four matte turnstile gates on a light background: three are open, the fourth is closed and marked with a turquoise indicator — illustration for an article on the Bitget hack and the phased resumption of withdrawals

Updated 2 October 2026: Bitget announced that withdrawals of other tokens, fiat and C2C services had resumed.

In brief: the Bitget hack of 24 September 2026 cost the exchange about $387.5 million — around 4.58 trillion soums at the Central Bank of Uzbekistan rate as of 1 October 2026 (11,808.76 soums per $1): Bitget gave this figure on 25 September 2026, revising its initial estimate of $351.6 million (≈4.15 trillion soums at the same rate). The exchange is restoring withdrawals in stages: BTC from 28 September, ETH from 29 September, USDT from 30 September; on 2 October 2026 Bitget said it had restored withdrawals of other tokens, fiat and C2C services and that the phased plan "has been fully completed". For a reader from Uzbekistan, something else matters more: Bitget is not in the license register of the National Agency of Perspective Projects (NAPP, retrieved 1 October 2026), and under PQ-3832 citizens of Uzbekistan may carry out transactions to buy, sell and (or) exchange crypto assets exclusively through national providers, except in cases provided for by legislative acts.

Timeline of the Bitget hack and the resumption of withdrawals

DateEventSource
24 September 2026, 18:31 UTC (23:31 Tashkent time)Bitget's security systems detected unauthorized transfers from some hot and warm wallets; withdrawals were suspended, while trading and deposits continued; initial estimate — about $351.6 million (≈4.15 trillion soums); cold wallets, according to the exchange, were not affectedBitget notice, 24 September 2026
25 September 2026The estimate was raised to $387.5 million (≈4.58 trillion soums): affected assets on the Zcash and TRON networks were added; a bounty program — 5% of frozen or recovered funds to whoever made that happen; Bitget does not guarantee paymentBitget, 25 September 2026
26 September 2026A schedule for the phased resumption of withdrawals was publishedBitget, 26 September 2026
28 September 2026, 08:00 UTCBTC withdrawals; according to Bitget CEO Gracy Chen, 9,585 requests for 4,098 BTC were processedBitget schedule, 26 September 2026; Bitcoin Magazine, 29 September 2026
29 September 2026, 08:00 UTCETH withdrawals (Ethereum, BSC, Arbitrum, Base, Optimism)Bitget schedule, 26 September 2026; crypto.news, 30 September 2026
30 September 2026, 08:00 UTCUSDT withdrawals (Ethereum, BSC, Solana, Tron); Bitget published the Mandiant and SlowMist reportsBitget schedule, 26 September 2026; Bitget, 30 September 2026
2 October 2026, 08:00 UTC (announcement published)Bitget announced that withdrawals of other tokens, fiat and C2C services (P2P in the schedule) had resumed and the plan was complete; the same day, withdrawals on some networks, including DOGE and LTC, were suspended due to "wallet maintenance"Bitget, 2 October 2026; Bitget on DOGE, 2 October 2026

How Bitget was hacked: what Mandiant and SlowMist found

On 30 September 2026, Bitget published the reports of the two firms investigating the incident. According to the exchange, both investigations identified a compromise of third-party security products through which the attacker gained access to the wallets; the findings, Bitget writes, "broadly align with the attack path Bitget previously disclosed".

  • SlowMist (investigation progress report as of 29 September 2026, times in UTC+8): the earliest malicious activity in the logs dates to 31 August 2026 — a zero-day vulnerability in a service on a node of third-party product A. On 25 September, the attacker logged into the management panel of product B using an employee account. SlowMist recovered from deleted files a withdrawal program that forged risk-control parameters. According to the records verified as of 29 September, the transfers ran from 02:31:00 to 05:23:11 on 25 September (UTC+8) — about 2 hours 52 minutes.
  • Mandiant (Google Cloud; status report of 28 September 2026): on 24 September 2026, the attacker gained privileged access to third-party security devices A and B, installed a web shell on device B and through it moved to Bitget's production wallet task server.

Both reports are interim: Mandiant describes access to devices A and B on 24 September, SlowMist the earliest malicious activity in the available logs of product A on 31 August. The vendor of products A and B is named neither in Bitget's four Help Center announcements (24, 25, 26 and 30 September 2026) nor in the reports by Mandiant (28 September 2026) and SlowMist (as of 29 September 2026) — checked on 1 October 2026. According to The Hacker News of 1 October 2026, Bitget notified the vendor and disabled the affected feature pending a fix.

Who is behind the attack. Bitget, as relayed by Bitcoin Magazine on 29 September 2026, called the attack method "highly consistent with known patterns of North Korean hacker organizations"; Gracy Chen cited on-chain analysis and the behavior of IP addresses (BleepingComputer, 28 September 2026). The Hacker News wrote on 1 October 2026 that analytics firms had found overlaps with wallets used to launder funds from previous hacks. The texts of the Mandiant (28 September 2026) and SlowMist (as of 29 September 2026) reports do not name the perpetrator.

What happens to client money: the protection fund and reserves

  • Balances. Bitget on 26 September 2026: "User account balances remain unaffected, and Bitget's Protection Fund covers the financial impact of this platform-wide incident" — balances are not affected, and the loss is covered by the exchange's protection fund.
  • Protection fund. On 24 September 2026, according to Bitget, it held more than $464 million (≈5.48 trillion soums). Bitcoin Magazine, citing Bloomberg, wrote on 29 September 2026 that after the hack the fund fell below $200 million (≈2.36 trillion soums), and Chen said the company was replenishing it with its own funds. On 30 September 2026, Bitget said in a press release that it had restored the fund to more than $300 million (≈3.54 trillion soums) — its minimum level.
  • Reserves. According to the proof of reserves snapshot at 09:00 UTC on 29 September 2026, Bitget's total reserve ratio is 131%, with all 19 covered assets above 100%: BTC — 142%, ETH — 110%, USDT — 107% (Bitget blog). crypto.news noted on 30 September 2026 that this is a point-in-time snapshot, not a full financial audit of the company.
  • Recovery of stolen funds. About $1.1 million (≈13 billion soums) was frozen by Circle, Tether and NEAR Intents (The Hacker News, 1 October 2026).

Bitget and Uzbekistan: is there a license and what the law says

No license. Bitget is not in the NAPP license register (retrieved 1 October 2026); the table of active licenses lists two crypto exchanges — COINPAY (CE #0004) and ASTERIUM (CE #0006). The list is in our article on licensed crypto exchanges.

The rule. PQ-3832 of 3 July 2018 (as amended by PQ-143 of 17 April 2026, in force since 20 April 2026), para. 3(e): from 1 January 2023, citizens and legal entities of the Republic of Uzbekistan may carry out transactions to buy, sell and (or) exchange crypto assets exclusively through national service providers in the established procedure, except in cases provided for by legislative acts (translated from Russian; lex.uz).

Administrative liability. Article 155-4 of the Code of Administrative Liability (introduced by Law No. ZRU-899 of 19 January 2024, in force since 20 April 2024; the Code was adopted on 22 September 1994 and has been in force since 1 April 1995; the text of the article in the current Code matches Law No. ZRU-899 — checked on 1 October 2026), on illegal acquisition, sale or exchange of crypto assets, provides for administrative detention of up to 15 days or, for persons to whom detention cannot be applied, a fine of 20–30 BCV, i.e. 8.8–13.2 million soums at a BCV of 440,000 soums (since 1 September 2026 under Presidential Decree PF-115 of 23 June 2026); in both cases with confiscation of the crypto assets and the instruments of the offense.

Criminal liability — Article 278-8 of the Criminal Code (the Criminal Code was adopted on 22 September 1994 and has been in force since 1 April 1995; the current version on lex.uz is dated 12 September 2026; the article was introduced by Law No. ZRU-899 of 19 January 2024, in force since 20 April 2024): part 1 — the same acts committed after an administrative penalty for the same acts; parts 2–3 — the same acts with aggravating circumstances, including on a large (part 2) or especially large (part 3) scale. More in our article on fines for crypto in Uzbekistan.

Cases involving Bitget. On 26 January 2026, Spot, citing the press service of the Bukhara Region Internal Affairs Department, reported a case against a native of Andijan Region who traded on Binance and Bitget without a license: 2,407 transactions from 20 April to 30 September 2025 worth 18.167 billion soums; the case was opened under paragraph (a) of part 3 of Article 278-8 of the Criminal Code (especially large scale). According to the same report, in August 2025 he had already been convicted of illegal trading in cryptocurrency worth 26 billion soums and sentenced to restriction of liberty. According to investigators cited by Spot, he also converted, using other people's cards, 1 billion soums withdrawn from the cards of victims and civil plaintiffs.

For the exchanges themselves, on 3 August 2026 NAPP put up for discussion a draft regulation on fines of up to 11 billion soums for foreign companies that provide crypto services to residents without a license. As of 26 September 2026 (the verification date in our breakdown), there was no registered act in the lex.uz database — it is a draft; details are in our breakdown. For Binance, NAPP described a route via the licensee COINPAY (NAPP statement of 29 January 2025); as of 1 October 2026, there are no NAPP statements about a similar partnership with Bitget in the register or in the news on napp.uz.

NAPP's response. The agency has published no statements of its own on the Bitget hack, either in the news section of napp.uz (latest entry — 28 September 2026) or in the Telegram channel @napp_uz (posts from 26 September to 1 October 2026, checked on 1 October 2026). The external news feed on napp.uz carries a link to a Financial Times article on the hack dated 25 September 2026.

What users from Uzbekistan should know

  • Money on an exchange is held by the exchange. During the Bitget incident, BTC withdrawals were closed from 24 to 28 September 2026; those of other tokens, fiat and C2C stayed closed until 2 October 2026, when Bitget announced they had resumed.
  • The legal route in Uzbekistan is licensed providers from the NAPP register; how to buy cryptocurrency through them is explained in our guide to buying cryptocurrency in Uzbekistan. How a hot wallet differs from a cold one is covered in our guide to storing cryptocurrency.

FAQ

How much was stolen from Bitget? According to Bitget's estimate of 25 September 2026 — about $387.5 million, or ≈4.58 trillion soums at the Central Bank of Uzbekistan rate as of 1 October 2026. The initial estimate on 24 September 2026 was $351.6 million; in the revised count, Bitget added assets on the Zcash and TRON networks.

When did Bitget fully reopen withdrawals? On 2 October 2026 — Bitget announced that withdrawals of other tokens, fiat and C2C services had resumed and that the phased plan was fully complete. BTC, ETH and USDT withdrawals, according to the exchange, resumed on 28–30 September 2026.

Were Bitget client balances affected? According to Bitget's statement of 26 September 2026 — no: balances are not affected, and the loss is covered by the exchange's protection fund. The proof of reserves snapshot as of 29 September 2026 showed a ratio of 131% across 19 assets; these are the exchange's own data at the time of the snapshot, not an audit.

Who hacked Bitget? Bitget links the attack to hackers from North Korea: CEO Gracy Chen cited on-chain analysis and the behavior of IP addresses (BleepingComputer, 28 September 2026). The Mandiant (28 September 2026) and SlowMist (as of 29 September 2026) reports do not name the perpetrator.

Is it legal to use Bitget in Uzbekistan? No, except in cases provided for by legislative acts: Bitget has no NAPP license (register, retrieved 1 October 2026), and under para. 3(e) of PQ-3832 (of 3 July 2018, as amended by PQ-143 since 20 April 2026), citizens and legal entities of Uzbekistan may carry out transactions to buy, sell and (or) exchange crypto assets exclusively through national service providers in the established procedure, except in cases provided for by legislative acts. For illegal acquisition, sale or exchange of crypto assets, Article 155-4 of the Code of Administrative Liability provides for administrative detention of up to 15 days or, for persons to whom detention cannot be applied, a fine of 20–30 BCV (8.8–13.2 million soums at a BCV of 440,000 soums since 1 September 2026); in both cases with confiscation of the crypto assets and the instruments of the offense.

Sources

Read also