- Bitget confirmed about $387.5 million moved to attacker addresses on Sept. 24, up from an initial $351.6 million after adding Zcash and TRON assets.
- CEO Gracy Chen said attackers spoofed transaction data in a compromised wallet backend; private keys and cold wallets were not taken.
- A User Protection Fund of more than $464 million is slated to cover the loss. Withdrawals restart in phases from Sept. 28.
Bitget said onchain tracing now puts assets transferred to attacker-controlled addresses at approximately $387.5 million after a Sept. 24 incident that first appeared as unauthorized outflows from some of the exchange’s hot wallets.
The exchange’s security systems flagged the transfers at 18:31 UTC on Sept. 24, according to a Bitget security notice. An initial estimate of $351.6 million was revised the next day after the firm added Zcash and TRON transfers missing from the first count. In a follow-up incident update, Bitget said the higher figure does not reflect further unauthorized transfers and that the incident remains contained.
CEO Gracy Chen said the attacker compromised a critical backend system inside Bitget’s wallet infrastructure, spoofed transaction data and triggered the firm’s own authorization process. Chen later wrote that private-key compromise has been ruled out. Cold wallets and the separate self-custodial Bitget Wallet product were not affected, the company said.
Affected assets include XRP, ETH, USDT, ZEC, USDC, USDT0, XAUt, BNB, AVAX and TRX across Ethereum and other EVM networks, the XRP Ledger, Zcash and TRON. In a livestream summary, Chen said XRP was the largest single-chain loss and that IP patterns and onchain signatures are consistent with techniques used by DPRK-linked groups, a link that has not been independently confirmed. Mandiant and SlowMist are assisting the investigation.
Bitget said customer balances remain intact and that the loss falls within its User Protection Fund of more than $464 million. Chen added that the firm holds over $1 billion in its own assets. The exchange launched a 5% recovery bounty for funds frozen or recovered through voluntary action and published a live tracing dashboard for industry partners.
Withdrawals remain paused as a security measure. In a withdrawal notice, Bitget said they will resume in phases: BTC on Sept. 28 at 08:00 UTC, ETH networks on Sept. 29, USDT on Sept. 30, and remaining tokens, fiat and P2P on Oct. 2. Chen said she will host a live AMA at 07:30 UTC on Sept. 28, 30 minutes before bitcoin withdrawals restart.
