When a crypto exchange halts withdrawals, the question that matters to you is rarely how the attack worked in technical terms. What matters is when your balance can move again, and in which o
When a crypto exchange halts withdrawals, the question that matters to you is rarely how the attack worked in technical terms. What matters is when your balance can move again, and in which order. Since September 26, 2026 there is an answer: Bitget has published a staggered schedule that begins on September 28 with Bitcoin and ends on October 2 with fiat money and the remaining tokens.
For investors in Germany a second circumstance applies, and it barely features in the international coverage: Bitget has not served the German market on a regular basis since January 2026 and lists Germany as a restricted country in its own terms of use. Anyone who still holds a residual balance there gets a window with this schedule, and it is worth knowing about.
The exchange has split the resumption into four stages, each starting at 08:00 UTC, which is 10:00 in German summer time. Bitcoin goes first, on the Bitcoin network, on September 28. Ether follows a day later, across the Ethereum, BNB Smart Chain, Arbitrum, Base and Optimism networks. USDT is released on September 30, via Ethereum, BNB Smart Chain, Solana and Tron. Last, on October 2, come the remaining tokens, fiat withdrawals and peer-to-peer trading.
A network here is the transfer route a balance uses to leave the exchange. The same coin can run over several networks, and each has its own fees, its own address formats and its own confirmation times. The staggering therefore means more than waiting for a calendar day: your preferred transfer route may only arrive in a later stage.
Trading and deposits continued throughout the freeze, according to the exchange; withdrawals alone were affected. Bitget also states that account balances remained unchanged and that the freeze was purely a security measure. That is the company's own account, and it becomes verifiable only once the first stage actually runs.
On September 24, 2026 crypto assets left several of the exchange's wallets without authorisation. The company dates detection to 18:31 UTC. The damage was first put at around $351.6 million and later revised upwards to $387.5 million; both figures are in circulation side by side, depending on the state of the analysis. According to the company, hot and warm wallets were affected, while the holdings kept offline remained untouched.
A hot wallet is a wallet whose keys stay permanently connected to the internet so that withdrawals can run automatically. That availability is exactly where its risk lies. Chief executive Gracy Chen told CoinDesk that private keys had not been compromised; instead the attackers had taken over a wallet backend, spoofed transaction data and thereby triggered the exchange's regular release process. Ten crypto assets across several networks were affected, among them XRP, Ether, USDT, Zcash, USDC, BNB, Avalanche and TRX. The largest single item, according to the breakdown, was around 102.93 million XRP.
The exchange states that the underlying vulnerability has been confirmed and fixed. Mandiant, Google's security arm, and SlowMist are involved in the forensic work, according to the company. Bitget has also announced a bounty programme: five percent on funds successfully frozen and five percent on funds successfully recovered, with measures ordered by courts or authorities excluded. Chief executive Chen has announced a public question-and-answer session for September 28 at 07:30 UTC.
The opening does not come all at once: four stages between September 28 and October 2 decide when a given balance can move.
The order looks arbitrary, yet it follows technical complexity. Bitcoin runs over a single network with a single address format and no smart contracts. A release can be switched back on there and observed with a manageable amount of checking. Ether and USDT hang off several chains at once, each with its own contract code and its own signature logic. Fiat withdrawals, finally, run through banking partners whose review processes the exchange does not control on its own.
In practice: the further back your asset sits in the schedule, the longer it stays exposed to the risk that the opening gets postponed. If you can choose which asset to pull out first, factor that order into your planning instead of waiting for the one stage that serves your favourite network.
This point decides whether you need to act. Bitget closed new registrations for users resident in Germany on January 16, 2026, and the company's terms of use, last updated on September 15, 2026, list Germany as a prohibited country. You cannot open a new account there in any case. The schedule is therefore relevant to one particular group: everyone holding a legacy account with a residual balance who has not cleared it yet.
For that group the resumption is a deadline rather than good news. A provider that itself lists your country of residence as restricted is no place to leave a balance permanently. The action here is to use the release and pull the holding out. Waiting for normal operations to return is the weaker course. If you need a new trading venue anyway, it is worth looking at our overview of the best crypto exchanges beforehand, because you should have the destination address ready before September 28 and not once the window is already open.
MiCA is the European regulation on markets in crypto assets. It requires a provider serving customers in the EU to be licensed for it, and it ties liability for customer assets held in custody to that licence. The sentence that matters to you: this liability hangs on the licence. Where the licence is absent, so is the claim the regulation would otherwise grant.
As of September 25, 2026 Bitget is not entered in the relevant European register. The company has filed an application with the Austrian financial market authority through its EU entity and confirmed this on July 2, 2026. An application, however, is not a permission. The transition period during which providers in the European Economic Area were allowed to continue without a licence of their own expired on July 1, 2026. What the duties of a licence involve in concrete terms is something we have set out in our overview of the MiCA obligations for crypto companies.
None of this amounts to a judgement about the company's intentions. It does amount to a sober reading of your position: if something goes wrong at an unlicensed provider, you depend on its voluntary undertaking, with no European liability claim behind you. Enforcement would, in case of doubt, have to be pursued where the company is based.
Bitget points to an in-house protection fund and states that it covers the financial consequences of the incident. On September 24 the fund was put at more than $464 million. Set against the revised damage figure of $387.5 million, this single incident claims around 84 percent of the cushion.
Such a fund is a voluntary promise by the company. It is not a statutory deposit guarantee. The German deposit guarantee of up to 100,000 euros applies to bank balances; crypto assets on a trading platform fall outside it. How robust protection promises of this kind are across the industry is something we calculated for several exchanges in a survey of our own on September 25. The short version: a fund held in crypto assets shrinks in exactly the market conditions in which it is needed.
Without a licence the counterweight is missing: protection then rests on the company's undertaking alone.
The stages open at 08:00 UTC, and experience suggests the rush is heaviest in the first hours. Three things should be done beforehand, because there will be no calm moment to sort them out once the window is open.
First, the destination address. It has to match the network released in your stage. A withdrawal over a network your destination wallet does not support is the most common way to lose a balance permanently. Second, the verification of your account: if two-factor protection sits on an old device or an identity check is outstanding, that costs you exactly the time you do not have. Third, the fees, which differ markedly between networks and which on small holdings can decide the route you take; how withdrawal fees and network fees differ is something we have broken down elsewhere.
One note on scale: on September 26, 2026 at around 10:50 UTC Bitcoin was trading at roughly $84,100, Ether at roughly $2,690 and XRP at roughly $1.55 (source: CoinGecko). Knowing what your residual holding is worth makes it easier to judge whether a withdrawal over an expensive network is worth it at all.
There are two serious options for the destination, and they differ less in effort than in the question of who holds the key. With self-custody the private key is yours, and so is sole responsibility: if the backup is lost, nobody can help you. In exchange there is no longer an operator whose wallet backend someone could take over. Which devices are suitable and how they differ is shown in our hardware wallet comparison.
The second option is a trading venue licensed for the German market. The advantage sits in the legal framework: at a licensed provider the duties arising from MiCA genuinely stand on your side. Convenience has little to do with it. Anyone who wants to keep trading after the withdrawal will be doing so on a different footing than before.
A third variant, simply leaving the balance where it is and waiting, is the weakest option at a provider without a licence for your country of residence. It relies on everything going well, with no claim to fall back on if it does not.
A widespread misconception keeps people from moving their balance. The one-year holding period under section 23 of the German Income Tax Act attaches to the moment of acquisition. Where the asset is stored does not enter into it. A transfer from an exchange to your own wallet is no disposal, so it neither triggers a taxable event nor restarts the period. Selling on the exchange in order to have euros paid out is a disposal, with all the tax consequences that follow.
In practice: simply pulling your holding out is unproblematic for tax purposes. Documentation does matter, though. When an exchange suspends withdrawals and later merges data retrospectively, the acquisition date and acquisition cost are not always cleanly traceable from the export history. Download your account's transaction history before you move the balance, and not months afterwards.
Three observable points tell you more than any announcement. The first is September 28 at 08:00 UTC: if the Bitcoin stage starts on time and without a further interruption, that is a solid sign the remaining stages will follow. The second is September 30 with USDT, because stablecoin outflows are typically the largest and put the heaviest demand on liquidity. The third is October 2 with fiat money and peer-to-peer, because banking partners have to play their part there.
If one of these stages is postponed or opened only partially, with amount caps for instance, that is the information that counts. A cap does not break the promise, but it does extend your wait, and it indicates how tight liquidity actually is. In the other direction: a stage that starts without caps and without delay defuses the obvious worry that the withdrawal freeze was more than a security measure.
Further reading: the schedule with all stages and networks at The Crypto Times, and the chief executive's account of the attack route at CoinDesk.
(As of September 26, 2026. This article is not investment advice. Prices and fee structures change; check the terms with the provider before you buy.)
