Bitget has raised the estimated value of assets taken in its Sept. 24 breach to $387.5 million as exchanges and security firms mobilize to freeze and recover the stolen funds.
Related Company Bitget Trading platform for crypto products
The new estimate is up from $351.6 million after further on-chain tracing identified Zcash and TRON assets that were excluded from Bitget's initial accounting, Chief Executive Officer Gracy Chen said in a Sept. 25 update. She said the increase reflected transfers made during the original incident and that no additional unauthorized transactions had occurred.
Table Showing Assets Stolen From Bitget (Source: Lookonchain)
Bitget said its investigation with blockchain security firms Mandiant and SlowMist remains underway, with further forensic findings expected as investigators establish how attackers breached its systems.
Related Asset Zcash ZEC · $1,558.91 24-hour change: up 0.07%
The exchange first detected the unauthorized transfers from some hot wallets at 18:31 UTC on Sept. 24 and suspended withdrawals while keeping deposits and trading operational. Its security team has since identified and patched the underlying vulnerability, according to the latest update.
The higher loss estimate comes as Bitget shifts its response toward tracing and recovery, drawing support from other crypto exchanges, blockchain projects and security companies.
Exchanges join effort to freeze stolen assets
Bitget said it has already frozen some affected assets in coordination with industry partners, though it has not disclosed their value.
Binance and Bybit are among the exchanges publicly supporting the recovery. Bybit's Chief Executive Officer Ben Zhou said the company would assist Bitget and update its LazarusBounty platform to track the stolen funds, returning support Bitget provided after Bybit's own $1.5 billion breach in 2025. Bitget said it would use LazarusBounty as a main channel for its recovery campaign.
Related Company Binance Global crypto exchange
Chen said exchanges, foundations and security teams had already moved to freeze some attacker-controlled assets. Bitget has also published a real-time tracing dashboard, a reporting portal and an API containing attacker addresses to allow exchanges, stablecoin issuers, bridges and other infrastructure providers to monitor the funds.
Related Company Bybit Cryptocurrency derivatives exchange
The exchange paired those efforts with a new Recovery Bounty Program offering rewards tied directly to frozen or returned assets.
Eligible parties whose voluntary actions freeze stolen funds can receive 5% of the amount successfully frozen. Bitget is separately offering 5% of funds successfully recovered through eligible voluntary efforts.
Freezes secured before the program's announcement can also qualify.
Bitget will determine eligibility and bounty amounts, while actions carried out under court orders, law enforcement requests or other compulsory legal processes are excluded.
The program could make the recovery campaign increasingly dependent on whether stolen assets reach infrastructure that can block their movement. Stablecoin issuers and centralized exchanges can freeze certain assets or accounts, while native cryptocurrencies moved to self-custodied addresses can be harder to stop.
Withdrawals remain the next test
For customers, withdrawals remain suspended more than a day after the breach.
Chen said Bitget is working to restore the service and will announce its withdrawal plan by Sept. 26 at 04:00 UTC. The company has not said withdrawals themselves will necessarily resume at that time.
Its latest security update says technical teams are validating the remediated systems and completing required checks before withdrawals can safely resume. Deposits and trading remain available.
Bitget previously said customer balances remained accurate and that its User Protection Fund, which held more than $464 million when the incident was disclosed, covered losses.
The revised $387.5 million estimate narrows that headline cushion to about $76.5 million before accounting for any assets recovered from the attackers. The protection fund's role will depend partly on how much of the stolen crypto Bitget and its industry partners ultimately recover.
The immediate milestone is the withdrawal announcement due Sept. 26. Beyond restoring customer access, the tracing effort will determine how much of the $387.5 million Bitget ultimately has to absorb and how much it can claw back through the exchange-wide recovery campaign.