Bitget Raises September Hack Loss Estimate to $387.5 Million After Adding Zcash and TRON Transfers
Bitget raised its estimate of assets moved to attacker-controlled addresses in the September 24 breach to $387.5 million, about 83.5% of its protection fund.
Read this event in español
Why it matters
Attacker access that reached the signing path without touching private keys is the same weakness Unchained identified in the February 2025 Bybit theft, and Chen said the techniques match those used by DPRK-linked groups. If the $387.5 million figure holds, most of a fund Bitget says covers hack losses is spent, and Sygnum's same-day offer of bank-held collateral for institutional clients shows that off-exchange custody still depends on the exchange for trading and withdrawals.
Where the sources disagree
How much the attacker took
$351.6 million initial estimate
Finance Magnates Crypto, CryptoSlate, Unchained, CryptoSlate
$387.5 million revised estimate
Finance Magnates Crypto, CryptoSlate, Unchained, CryptoSlate
Bitget's first notice put the figure at $351.6 million and its September 25 update raised it to $387.5 million, so the two numbers describe the same theft at different stages of accounting rather than two independent counts.
Whether the XRP Ledger address belongs to the attacker
Unchained could not yet tie the address to the attacker
Unchained
Bitget's Friday update lists the address as one of the attacker's
Unchained
Unchained reported that XRP wallets labelled as Bitget's had sent a large sum to the address minutes before Bitget's first estimate but could not yet tie it to the attacker, while Bitget's later update lists the same address as one of the attacker's.
Figures that do not reconcile
Found by comparing the numbers in the reports automatically. They are differences, not yet confirmed to be about the same thing.
amount taken
$388 Million
Finance Magnates Crypto
$351.6 million
CryptoSlate
Finance Magnates Crypto reports $388 Million, CryptoSlate reports $351.6 million (9% apart).
amount taken
$388 Million
Unchained
$351.6 million
CryptoSlate
Unchained reports $388 Million, CryptoSlate reports $351.6 million (9% apart).
size of the raise (bitget exchange)
$464 million
Finance Magnates Crypto
$387.5 million
Unchained
Finance Magnates Crypto reports $464 million, Unchained reports $387.5 million (16% apart).
Key facts
Bitget raised its estimate of assets moved to attacker-controlled addresses in the September 24 breach to $387.5 million from $351.6 million.
387,500,000 USDDisputed figureReported by Finance Magnates Crypto
The increase came from counting transfers in Zcash and TRON that the first calculation had left out.
Reported by Finance Magnates Crypto
CEO Gracy Chen said the attacker compromised a backend system in Bitget's wallet infrastructure, spoofed transaction data and triggered the exchange's authorization process, so Bitget's own systems signed the transfers without any private key being exposed.
Reported by Unchained
Bitget detected unauthorized transfers from some hot wallets at 18:31 UTC on September 24 and suspended withdrawals while keeping deposits and trading open.
Reported by Finance Magnates Crypto
Finance Magnates put the $387.5 million at about 83.5% of a User Protection Fund the exchange states is worth more than $464 million.
83.5 %Disputed figureReported by Finance Magnates Crypto
The protection fund holds 5,500 Bitcoin and averaged $382 million in August, ranging from $345.3 million to $441.5 million.
5,500 BTCReported by Finance Magnates Crypto
Mandiant and SlowMist are helping Bitget investigate how the attackers breached its systems.
Reported by CryptoSlate
Gracy Chen said the attack is consistent with techniques used by DPRK-linked hacker groups.
Reported by Unchained
What happened
Bitget said on September 25 that assets moved to attacker-controlled addresses during the September 24 breach total about $387.5 million, up from its first estimate of $351.6 million, which left out transfers in Zcash and TRON. CEO Gracy Chen said on X that the attacker compromised a backend system inside Bitget's wallet infrastructure, spoofed transaction data and triggered the exchange's own authorization process, so Bitget's systems signed the transfers and the attacker never held private keys. The exchange detected the transfers from some hot wallets at 18:31 UTC on September 24, suspended withdrawals while keeping deposits and trading open, and says it has patched the underlying flaw. Finance Magnates put the loss at about 83.5% of a User Protection Fund the exchange values at more than $464 million, and said Bitget would have to top the reserve back up to its $300 million commitment, while the fund itself holds 5,500 Bitcoin and averaged $382 million in August. Mandiant and SlowMist are assisting the investigation, Binance and Bybit have publicly backed the recovery effort, and Bitget says it has frozen some affected assets without disclosing their value. Chen said the attack matches techniques used by DPRK-linked hacker groups, which Unchained compared to the $1.5 billion Bybit theft of February 2025; how much of the $387.5 million can be frozen or recovered is still unquantified.
How the story developed
- Update
Unchained reports XRP wallets labelled as Bitget's sent a large sum to one address
Unchained published the report minutes before Bitget's first estimate and could not yet connect the address to the attacker.
- Official statement
Gracy Chen describes the compromise on X
Chen said the attacker spoofed transaction data and triggered Bitget's own authorization process, so no private keys were involved.
- Update
Bitget detects unauthorized transfers from hot wallets
The exchange's security systems flagged transfers at 18:31 UTC, and the first notice put the loss at about $351.6 million across parts of its hot and warm wallet layers, with cold wallets described as secure.
- Update
Bitget raises the loss estimate to $387.5 million
Zcash and TRON transfers missed by the first calculation were added, and Chen said no further unauthorized transactions had taken place.
- Official statement
Sygnum offers bank-held collateral to Bitget institutional clients
The Swiss bank said eligible clients that onboarded with it could trade against collateral held at Sygnum rather than in Bitget wallets, and neither side disclosed uptake or terms.
- Official statement
Bitget says the flaw is fixed and sets a deadline on withdrawal news
The Friday update lists an XRP Ledger address among the attacker's and said the status of withdrawals would be given by midnight ET, and Binance and Bybit publicly support the recovery effort.
- First report
First report by Finance Magnates Crypto
Bitget’s $388 Million Hack Could Consume 84% of Its Protection Fund
- Independent corroboration
Independently corroborated by CryptoSlate
Bitget’s hack just got $36 million bigger, and now there’s a bounty on the stolen crypto
How coverage built up
Independent sources over time, counted the way the consensus panel counts them: a republication of a wire story does not move the line.
- 25 Sept 2026, 17:30 UTC: Finance Magnates Crypto, Mainstream media — 1 independent source, 1 reports
- 25 Sept 2026, 19:20 UTC: CryptoSlate — 2 independent sources, 2 reports
- 25 Sept 2026, 23:16 UTC: Unchained — 3 independent sources, 3 reports
Affected entities
Also mentioned: XRP, South Korea
Original sources
| Publisher | Report | Role | Published |
|---|---|---|---|
| Finance Magnates Crypto Mainstream media | Bitget’s $388 Million Hack Could Consume 84% of Its Protection Fund | Original | |
| Unchained Crypto media | Bitget Confirms It Was Tricked Into Approving Its Own $388 Million Theft | Independent | |
| CryptoSlate Crypto media | Bitget’s hack just got $36 million bigger, and now there’s a bounty on the stolen crypto | Independent | |
| CryptoSlate Crypto media | Swiss bank shields Bitget institutions while retail funds freeze | Independent |
Related events
THORChain declines Bitget request to block addresses tied to $387.5 million hack
Bitget asked THORChain to refuse service to addresses holding its stolen funds; THORChain says a network halt is not a selective freeze and it does not censor by design.
North Korea-linked SquidSquad suspected in $2.84M BNB Chain theft
Blockchain investigator ZachXBT attributes a $2.84 million BNB Chain theft to North Korea-linked group SquidSquad, tracing funds through Tornado Cash to Tron wallets tied to prior North Korean addresses.
Binance Launches 24/7 USD/BRL Perpetual Futures With 100x Leverage
Binance is launching a 24/7 US dollar-Brazilian real perpetual futures contract on September 21, settling in USDT with up to 100x leverage.
Bitcoin options open interest nears $100 billion ahead of $16 billion Sept. 25 expiry
Bitcoin derivatives open interest totals about $100 billion, with $16 billion in options expiring on Deribit at 08:00 UTC on Sept. 25 and calls at about 60% of open interest.
Bitcoin Options Traders Concentrate $2.07 Billion in $95,000 Calls for October 30 Expiry
Deribit's largest bitcoin options position holds 25,030.6 BTC in $95,000 calls expiring October 30, while max pain sits near $78,000.
Binance Starts 24/7 FX Perpetual With USD/BRL Contract
Binance Futures began trading a 24/7 USD/BRL perpetual, USDBRLUSDT, on September 21 at 14:00 UTC with leverage up to 100x.
