Bitget Raises Its Hack Loss to $387.5M After a Recount

Bitget detected unauthorized transfers at 18:31 UTC on September 24, and now puts the loss at $387.5 million, up from the $351.6 million it reported the day before. The exchange says its cold wallets were never touched and that the theft came from a forged withdrawal authorization rather than a compromised private key. Withdrawals remain suspended while the security review continues, while deposits and trading keep running normally.

Key Takeaways

• $387.5M pulled from Bitget’s hot and warm wallets on September 24, cold wallets untouched
• The User Protection Fund ($464M, roughly 5,500 BTC) covers the full loss
• Circle and Tether froze $318,000 of the haul, a sliver of the total taken

Bitget says only its withdrawal system was compromised

Bitget confirmed the incident in a security notice posted on its support center. The attacker compromised an internal system within the wallet layer, then forged transfer data to trigger the authorization process. No private key was ever compromised, the exchange says, which narrows the attack surface to the withdrawal pipeline rather than the vault itself.

That playbook, a compromised internal system rather than a leaked key, echoes the incident that forced Crypto.com to halt its own blockchain after a $75M theft earlier this month.

The exchange splits its reserves across three tiers: hot wallets permanently connected, warm wallets with intermediate access, and cold wallets kept offline. Only the first two were hit. The cold wallets, which hold the bulk of the platform’s assets, stayed intact according to Bitget.

The tally moved twice inside twenty-four hours. Early on-chain estimates sat near $183 million, the exchange then published $351.6 million, and lifted the total to $387.5 million on September 25 after identifying further assets on the Zcash and TRON networks. The haul spans more than five separate blockchains, which explains why the figure took so long to settle.

The stolen assets include roughly 103 million XRP, worth about $157 million, and some $183 million in stablecoins, with ETH and other tokens making up the rest. The confirmed figure makes this the largest theft reported at a centralized exchange so far this year. It tops the $319M in bitcoin stolen from Blockstream’s Liquid sidechain earlier in September, an episode that had already shaken confidence in shared custody infrastructure.

The protection fund absorbs the loss, withdrawals stay frozen

The platform says the full amount falls within its User Protection Fund, which holds more than $464 million, or roughly 5,500 BTC. Gracy Chen said customer account balances remain accurate and that user funds are protected.

The chief executive walked through the mechanics in an update posted to her own account the day after the breach: the forgery hit the platform’s internal transfer data. User withdrawal requests and the company’s private keys stayed out of reach.

Withdrawals stay suspended as a precaution while the security team finishes its review. Deposits and trading keep operating normally, which sets this incident apart from a full platform shutdown.

The exchange brought in two outside firms, Mandiant and SlowMist, to lead the technical investigation. A full incident report, covering root cause analysis and corrective measures, is due within 24 hours of the breach.

The fund itself has never been tested at this scale before. Covering $387.5 million would draw down more than four fifths of its stated $464 million balance in a single incident, leaving a far thinner cushion should the exchange face a second breach before the reserve gets rebuilt.

This is not the first time an exchange has had to manage a confidence crisis after an incident: Polish exchange Zondacrypto saw a fifth suspect jailed pending trial in its own fraud case, a reminder that legal proceedings tied to crypto platforms often stretch across months.

Also on Cryptonomic:

• CME Lists Uniswap Futures Starting October 19
• Bitcoin Options Worth $15.9B Expire on Friday
• Bitcoin Holds $86,400 on ETF Flows and Cheaper Oil

The stablecoin issuer freeze stops at $318,000

Circle froze 99,990 USDC at 05:00 UTC on Friday, on an address Etherscan labels “Bitget Exploiter 8.” Tether followed roughly seven hours later, locking 218,023 USDT through a multisignature transaction. The two freezes cover about $318,000 in total, against the $387.5 million that left the platform.

The gap comes down to a plain technical limit. A stablecoin issuer can freeze tokens on its own contract, because it keeps administrative control of that contract. Ether settles at the Ethereum protocol level, where no single party can lock a balance. The same frozen address still held roughly 170 ETH that nobody could touch.

The rest of the haul has already moved that way. More than 63,000 ETH sits across other addresses linked to the attack, beyond the reach of any issuer action. Converting freezable assets into ether has become the standard reflex after a breach, precisely because it shuts the door on blacklists.

Recovery stays possible through slower channels. Earlier in September, Blockstream recovered 3,400 of the 4,000 bitcoin taken from its sidechain by negotiating directly with the exploiter. Nothing suggests a similar route is open here, and Bitget has announced no legal action.

Follow the story on Cryptonomic.