Bitget has increased its estimated losses from the Sept. 24 security breach to $387.5 million, as security firms and rival exchanges band together to track down and freeze the pilfered funds.
In a Sept. 25 update, Chief Executive Officer Gracy Chen explained that the revised figure—up from the initial $351.6 million—stems from continued on-chain analysis that uncovered Zcash and TRON holdings previously left out of the initial calculation. She noted that this bump accounts for transfers executed during the original attack rather than any new unauthorized activity.
According to Bitget, joint investigations alongside blockchain security companies SlowMist and Mandiant are ongoing, with additional forensic insights anticipated as specialists map out how the hackers penetrated the platform.
The exchange first spotted the illicit withdrawals targeting specific hot wallets on Sept. 24 at 18:31 UTC, prompting an immediate halt to withdrawals while trading and deposits stayed active. The company’s security personnel have since isolated and fixed the vulnerability, the latest statement confirmed.
As the losses mount, Bitget’s strategy has pivoted toward asset tracing and retrieval, backed by external blockchain projects, security vendors, and fellow crypto platforms.
Exchanges join effort to freeze stolen assets
Bitget reported that it has already successfully locked down a portion of the impacted funds alongside industry collaborators, though the exact monetary value remains undisclosed.
Binance and Bybit have stepped forward to publicly endorse the recovery initiative. Bybit CEO Ben Zhou stated that his firm would lend a hand to Bitget and adapt its LazarusBounty platform to monitor the missing funds—returning the favor after Bitget aided Bybit following its own $1.5 billion exploit in 2025. Bitget confirmed it will lean on LazarusBounty as a primary tool for its recovery drive.
Chen noted that various foundations, security teams, and exchanges have already taken steps to immobilize wallets tied to the attacker. Furthermore, Bitget has launched a reporting portal, an API containing malicious wallet addresses, and a live tracing dashboard to help bridges, stablecoin issuers, exchanges, and other infrastructure operators keep tabs on the money.
Alongside these measures, the exchange unveiled a Recovery Bounty Program designed to incentivize the freezing and returning of stolen crypto.
Participating individuals or entities whose voluntary actions lead to the freezing of stolen coins can earn 5% of the frozen sum. Bitget is providing an identical 5% reward for funds successfully brought back through eligible voluntary measures.
Freezes executed prior to the official announcement of the program are also eligible.
Bitget retains the authority to evaluate claims and decide bounty payouts, while actions taken pursuant to law enforcement directives, court orders, or other mandatory legal mandates are disqualified.
The effectiveness of this program may hinge on whether the stolen tokens cross paths with systems capable of halting transactions. While centralized platforms and stablecoin creators can block specific balances or accounts, native digital currencies routed to self-custody wallets present a tougher roadblock.
Withdrawals remain the next test
For everyday users, withdrawal capabilities remain turned off more than 24 hours after the hack occurred.
Chen stated that the platform is actively working to bring the feature back online and will issue a withdrawal roadmap by Sept. 26 at 04:00 UTC. The exchange did not guarantee that customer withdrawals would instantly reopen at that moment.
Its most recent security briefing notes that engineering teams are currently testing the patched infrastructure and performing mandatory verifications prior to safely reopening withdrawals. Trading and deposits continue to function normally.
Bitget previously asserted that client account balances remain intact and that its User Protection Fund—which stood at upwards of $464 million when the breach came to light—will cover the deficit.
The updated $387.5 million loss figure shrinks that safety buffer down to roughly $76.5 million before factoring in any capital recovered from the hackers. Ultimately, the extent to which the protection fund must be tapped depends on how much crypto Bitget and its partners can successfully claw back.
The immediate hurdle is the upcoming withdrawal update slated for Sept. 26. Beyond restoring account access for users, the outcome of the tracing operation will dictate how much of the $387.5 million Bitget is forced to absorb versus what it manages to recover via the cross-industry campaign.
