Bitget revises its September 24 hack estimate to $387.5 million in affected assets. The increase does not mean that an additional $35.9 million was stolen. Bitget says the revised figure come
Bitget revises its September 24 hack estimate to $387.5 million in affected assets. The increase does not mean that an additional $35.9 million was stolen. Bitget says the revised figure comes from a more complete reconciliation of transactions linked to the original attack, including crypto assets on Zcash and TRON that were not included in its first estimate.
According to Bitget’s latest update, approximately $387.5 million in assets were transferred to addresses controlled by the attacker during the incident. The difference with the initial estimate is $35.9 million, or about 10.2%. The crypto attack began at around 18:31 UTC on September 24 and affected portions of Bitget’s hot and warm wallet infrastructure across several blockchains.
Bitget says user balances were not affected. The crypto exchange also states that its private keys were not compromised and its cold wallets were not affected. The claims are being investigated with the assistance of Mandiant and SlowMist, which are helping with forensic analysis and on-chain tracing.
The crypto incident appears to have targeted the systems controlling withdrawals rather than Bitget’s cold-wallet private keys. Bitget says the attacker exploited a vulnerability in a third-party security product to obtain high-level internal credentials. Those credentials were then allegedly used to send fraudulent withdrawal commands that bypassed existing risk controls.
The crypto exchange says the vulnerability has since been fixed and that no further unauthorized transfers have been identified. Bitget has also launched a recovery bounty program and is working with industry partners to freeze and recover affected assets. However, the exchange has not yet disclosed how much of the $387.5 million has ultimately been recovered.
Bitget has been progressively restoring withdrawals after the crypto security incident. BTC withdrawals reopened on September 28, followed by ETH on September 29 and USDT on September 30 :
By 09:00 UTC on September 28, Bitget said it had processed 9,585 BTC withdrawal orders totaling 4,098.03574 BTC. The next major milestone is October 2, when the exchange crypto plans to restore other tokens, fiat withdrawals and P2P services.
For now, $387.5 million represents the estimated amount transferred during the September 24 incident, not necessarily the final unrecovered loss. The ongoing recovery effort and Bitget’s forthcoming crypto security report should provide a clearer picture of the final financial impact.
