Bitget has moved to crowdsource the recovery of stolen funds, announcing a bounty program that pays 5% of any assets frozen or recovered through voluntary assistance from exchanges, security
Bitget has moved to crowdsource the recovery of stolen funds, announcing a bounty program that pays 5% of any assets frozen or recovered through voluntary assistance from exchanges, security researchers, and the broader community. The exchange will use Bybit's Lazarus bounty site as a core submission channel for the initiative.
Bitget has raised the estimated value of assets affected by its September 24 security breach to approximately $387.5 million, up from an initial estimate of $351.6 million.CEO Gracy Chen said the revised figure reflects a more complete accounting of transfers made during the incident, including $ZEC and $TRX assets that were not included in the original estimate.She stressed that the increase does not represent additional unauthorized transfers.
Security systems at the Seychelles-based platform flagged unauthorized transfers from some of its hot wallets at 18:31 UTC on Thursday.The breach reached parts of Bitget's hot and warm wallet layers, while cold wallets, which sit offline, were not hit.The exchange says it identified and patched the vulnerability within 24 hours.
CEO Chen told customers their account balances remain accurate and that the entire loss sits inside Bitget's User Protection Fund, which she valued at more than $464 million.Bitget has said the fund is 5,500 bitcoin, so the dollar cushion moves with the bitcoin price until a payout is settled.
Chen launched a recovery bounty offering 5% for voluntarily freezing attacker funds and 5% for voluntary recovery, plus a tracing dashboard and a path to submit leads through Bybit's Lazarusbounty site.She said some blockchain foundations have already frozen attacker wallets, and Circle and Tether separately blacklisted one related address holding about $318,000 in USDC.
Withdrawals are paused pending a security review, but deposits and trading remain open. Bitget said it will announce a withdrawal plan by September 26 at 4:00 AM UTC.The exchange added that its investigation with Mandiant and SlowMist is ongoing, and that further findings will be shared as they become available.
With nearly $388 million at stake, the bounty's success could set a precedent for how exchanges handle post-breach recoveries.
Sources:Gizmodo: North Korea 'Very Likely' Behind $388 Million Hack of BitgetCrypto Briefing: Bitget raises breach estimate to $387.5M and launches recovery bounty
