Bitget has raised its estimate of assets transferred to attacker-controlled addresses in its Sept. 24 security incident to approximately $387.5 million, up $35.9 million — about 10.2% — from its previous accounting, according to Cointribune. The exchange said the increase comes from a more complete reconciliation of transactions tied to the original attack, including crypto assets on Zcash and TRON that were left out of the first figure, and not from additional unauthorized transfers. Crypto.news reported that the estimate had risen from $351.6 million to $387.5 million after investigators added additional Zcash and Tron-related transfers. U.today, meanwhile, described the amount as roughly $388 million in its own accounting of the incident, a minor rounding difference across the three reports.
On Sept. 30, CEO Gracy Chen said withdrawals for BTC, ETH and USDT were already running and that the exchange’s Protection Fund had climbed back above $300 million, describing the business as “gradually back to usual.” The exchange flagged roughly $388 million in its report on the incident, tied to its latest reconciliation and classification of affected transactions, per U.today.
Also read: Bitget Hack: $157M in Stolen XRP Cannot Be Frozen
Key facts
- Bitget’s latest estimate of assets transferred during the Sept. 24 incident is approximately $387.5 million, a $35.9 million increase (about 10.2%) reflecting revised accounting, not additional theft (Cointribune).
- The attacker exploited a flaw in a third-party security product to obtain high-level internal credentials, then sent fraudulent withdrawal commands that bypassed risk controls, according to CEO Gracy Chen (U.today).
- BTC withdrawals reopened Sept. 28 at 08:00 UTC, ETH on Sept. 29, and USDT on Sept. 30 across Ethereum, BNB Smart Chain, Solana and Tron (Crypto.news).
- Other crypto tokens, fiat withdrawals and P2P services are scheduled to return Oct. 2 at 08:00 UTC (Cointribune, Crypto.news).
- Bitget’s 47th proof-of-reserves report, taken at 09:00 UTC on Sept. 29, showed a 131% overall reserve ratio, with all 19 covered assets above 100% (Crypto.news).
How the attack unfolded
Crypto.news reported that the incident began at 18:31 UTC on Sept. 24, when Bitget detected unauthorized transfers from portions of its hot and warm wallet infrastructure. U.today, citing Chen, said the attacker first made two small transfers — 0.84 ETH from an Ethereum hot wallet and 93 TRX from a Tron hot wallet — that fell below the exchange’s risk-control threshold and did not trigger an alert. Between 18:58 and 20:09 UTC, the attacker initiated 17 larger transfers spanning Ethereum, XRP, Zcash, BNB Smart Chain, Base, Arbitrum, Optimism and Avalanche, with a combined estimated value of about $361 million, per U.today. A second wave of seven transfers between 20:55 and 21:23 UTC involving Avalanche, XRP, Ethereum, Zcash, Algorand, TIA and Cosmos was valued at roughly $30 million.
Bitget says its private keys and cold wallets were not compromised. Mandiant and SlowMist are assisting with forensic analysis and on-chain tracing, and the exchange reported the incident to law enforcement. U.today noted the company intends to publish an official security report this week, and Cointribune said the exchange has not yet disclosed how much of the $387.5 million has been recovered.
Also read: Bitget resumes BTC withdrawals as $387.5M hacker routes ETH via THORChain
Reserve ratio and the Protection Fund
Crypto.news reported that the Sept. 29 snapshot showed Bitcoin at a 142% reserve ratio, ETH at 110%, USDT at 107%, XRP at 107% and USDC at 154%. Chen said proof of reserves matters most when users want to verify the numbers themselves, and that users can check inclusion through Bitget’s Merkle Tree-based system. The exchange’s Protection Fund returned above its $300 million baseline after falling from more than $464 million as the exchange moved assets during the withdrawal restart, per Crypto.news. U.today reported the fund exceeded $464 million and that the temporary withdrawal pause was a security measure, not a sign of insufficient user assets.
THORChain dispute and recovery efforts
Asset recovery has continued separately from the operational reopening. Bitget published attacker addresses and asked exchanges, stablecoin issuers and researchers to help freeze funds, and Chen asked THORChain to refuse service to listed attacker addresses, arguing that “decentralization is a design principle, not a shield for facilitating known stolen funds.” THORChain rejected the request, saying its emergency halt protects the network itself rather than freezing a single address or transaction. Crypto.news reported that CoinDesk identified 27 successful swaps converting roughly 2,390 ETH linked to the attacker into 75.2 BTC, worth about $6.3 million at the time. Circle and Tether had frozen around $318,000 in USDC and USDT linked to the incident by Sept. 26, and AMLBot traced roughly four BTC into a Wasabi CoinJoin transaction. Bitget has offered a 5% bounty for qualifying assistance that results in stolen funds being frozen and a separate 5% reward for successful recoveries.
Why it matters
Bitget’s mid-incident reopening is unusual for a breach of this size — exchange halts often last longer, and the staged schedule gives users a measurable timeline rather than an open-ended freeze. The reserve snapshot and the Protection Fund refill are the two figures most users can verify independently, and both are being published while the investigation is still active. The standoff with THORChain also highlights a practical limit to recovery: funds that move through permissionless cross-chain infrastructure can be hard to stop even when an exchange identifies the wallets.
What to watch
The final stage of the rollout is Oct. 2 at 08:00 UTC, when other tokens, fiat and P2P services are due back. Bitget’s official security report is expected this week, and it should clarify how much of the $387.5 million was recovered. Continued tracking of the listed attacker addresses and any further freeze requests will show whether more funds can be blocked.
This article is not financial advice. Crypto markets and exchange balances are volatile and uncertain, and readers should do their own research before making any decisions.
Reported by cointribune.com.
Sources: Cointribune, Crypto.news, U.today
