Ledgers Academy Letter
The Daily Ledger: 26 September 2026
Bitget published its recovery plan two days after the breach: withdrawals return one asset at a time, bitcoin first on Monday at 08:00 UTC. Every asset has its own keys and its own route out of cold storage, which is why the order exists and why it costs some customers more than others.
Subject: Bitget will reopen withdrawals one asset at a time, starting with bitcoin on Monday
Preview: The schedule is published and bitcoin goes first at 08:00 UTC. The order is not arbitrary, and the asset you happen to hold decides when you can leave.
THE DAILY LEDGER
26 September 2026
Bitget publishes a phased plan to restore withdrawals after Thursday's breach, offers a 5 percent recovery bounty, and bitcoin spends a quiet Saturday just above $84,000
Editor's note: prices are CoinGecko 00:00 UTC snapshots for 26 September 2026, checked again at 11:00 UTC (13:00 Europe/Stockholm). No completed fund flow data exists for the weekend. The last full week for US spot ETFs ended on Friday 25 September.
Bitget published its recovery plan this morning, two days after losing roughly $351.6 million out of its hot and warm wallets. Withdrawals come back one asset at a time, bitcoin first on Monday at 08:00 UTC, then ether and other tokens, then USDT, then everything else. An exchange restores withdrawals in phases because every asset has its own keys and its own path out of cold storage, and opening them all at once would mean trusting all of those paths at the same moment.
1. The Day in Numbers
- Bitcoin: $84,076 at 00:00 UTC, down about 0.4 percent from Friday's open and roughly 3 percent below Tuesday's high.
- Ether: $2,691 at 00:00 UTC, effectively flat on the day.
- Fear and Greed Index: 74, Greed, up three points from Friday's 71 despite the week's exchange news.
- Bitcoin market value: $1.689 trillion at 00:00 UTC, with ether at $328 billion.
- Last completed ETF week: about $2.4 billion in across the five sessions to Friday 25 September. Weekends produce no flow data, so nothing here is live.
2. Why an exchange restores withdrawals in phases after a hack
A withdrawal is not one system. It is one system per asset. Bitcoin, ether, an ERC-20 token and a tether balance each have their own keys, their own signing arrangement and their own replenishment route from cold storage into the layer that pays customers. After a breach, the operator does not yet know which of those routes was touched.
Phasing buys two things. It lets the operator watch real withdrawal traffic against real reserves for one asset before exposing the next, and it contains the damage if a signing path is still compromised: a mistake on bitcoin does not empty the ether wallets. Bitget has also offered a 5 percent bounty to anyone who helps freeze or recover attacker-held funds, a standard move that depends entirely on the cooperation of exchanges and stablecoin issuers downstream.
The cost falls on customers unevenly. If your balance is in an asset scheduled for Friday, you wait while holders of earlier assets leave ahead of you, and you watch the queue in public. That visibility can be self-fulfilling: a published schedule tells everyone exactly when to rush for the door. What remains unknown is how large the outflow will be once the gates open.
3. Today's Headlines
A record ETF week lands in the same seven days as the hack
The five sessions to Friday brought about $2.4 billion into US spot bitcoin funds, the strongest week since October 2025. The coins behind those funds sit with a qualified custodian rather than in an exchange hot wallet, which is why one number can be a record in the same week another is a loss.
Sentiment ignores the breach
The Fear and Greed Index rose to 74 from 71. The index is built from volatility, volume, social posts and dominance, not from any measure of custody risk, so a theft at one venue does not register in it directly.
No new international development confirmed
Saturday produced no verified policy or regulatory news outside the United States. The week's two European items, the ECB's Pontes launch on Monday and the ESMA supervisory priority on Wednesday, were covered as they happened.
4. Security Note
The published recovery schedule is also an attack surface. Anyone can read which asset reopens on which day, which means phishing crews can time messages to the hour and reference a real, verifiable deadline. Expect messages claiming your asset's window is closing early, or offering to move you up the queue.
The rule: get the schedule from the exchange's own announcement page, reached by typing the address, and treat any message that arrives through email, direct message or search advertising as hostile by default. There is no early window and no queue to be moved up. If you do withdraw on Monday, send to an address you have used before, and check the first and last four characters against your own records rather than against anything on screen. Our note on address poisoning and dusting explains why a familiar-looking address can be the wrong one.
5. From the Academy Library
Reserve coverage and what a snapshot does and does not prove are in proof of reserves. Where a balance should sit when you do not need it on an exchange is in the cold storage guide, this year's incidents are on the crypto exploit tracker, and new readers can start at Academy School.
Two days from loss to published timetable is fast by the standards of this industry. Monday at 08:00 UTC is when we find out what customers think of it.
Disclaimer: This publication is for education and information only. It is not financial, investment, legal, tax, or security advice.
Sources and further reading
- Bitget: withdrawals to resume in phases
- The Crypto Times: the full phased withdrawal schedule
- CoinDesk: Bitget loses $352 million and says user funds are safe
- CoinReporter: spot bitcoin ETFs record 2026's strongest weekly inflows
- CoinGecko: daily price and market value snapshots used above
- Alternative.me: Fear and Greed Index