Bitget raises hack estimate to $387.5 million as withdrawals stay paused

Bitget raises breach estimate to $387.5 million

Bitget has raised its estimate of the assets sent to attackers in its Sept. 24 breach to about $387.5 million, up from $351.6 million. The crypto exchange said the increase comes from adding Zcash and TRON assets that were missing from its first count.

In a Sept. 25 update, Bitget said the higher figure covers transfers made during the original incident and does not mean a second theft happened. Withdrawals on the exchange, where users buy, sell and store digital assets, are still paused.

Explorer records reviewed by The Defiant show about 102.98 million XRP and 31,890 ETH leaving wallets labeled as belonging to Bitget and arriving at addresses the exchange has now identified as attacker-controlled, along with stablecoins, tokenized gold and other assets.

Key numbers from the breach

• The revised estimate is about $387.5 million, compared with $351.6 million in Bitget's first notice.
• Roughly 102.98 million XRP and 31,890 ETH were recorded moving from Bitget-labeled wallets.
• Transfers also included 34.75 million USDT, about 3,000.32 XAUt (a gold-backed token), 21.06 million USDC, 19.67 million USDT0, 12,719.46 BNB, 821,011.97 AVAX and 20.59 million TRX.
• Bitget said its User Protection Fund covers the incident, and put the fund's holdings at more than $464 million in its initial notice.
• CEO Gracy Chen promised an update on withdrawal "status/timing" by midnight ET at the start of Sept. 26.

What Bitget's Sept. 25 update says

Bitget's own notice states that the larger loss figure reflects transfers during the original incident rather than a new theft. The exchange also says some affected assets have been frozen with the help of industry partners.

Bitget is offering bounties of 5% for eligible voluntary freezing and 5% for eligible recovery. Its latest notice says the underlying vulnerability has been identified and fixed, with security validation now under way before withdrawals can resume.

What blockchain records show

XRPSCAN records show three payments from accounts labeled Bitget (1) and Bitget (2): about 2.25 million, 91.42 million and 9.31 million XRP. They went to the XRP address Bitget named in its update.

The ETH total was split across three networks, all sent to the same 0x770b...463Ee address: about 24,597 ETH on Ethereum, 5,738 ETH on Optimism and 1,555 ETH on Base. Other transfers to that address included 34.75 million USDT and about 3,000.32 XAUt on Ethereum, 21.06 million USDC across Ethereum and Avalanche, 19.67 million USDT0 on Arbitrum, 12,719.46 BNB on BNB Chain and 821,011.97 AVAX on Avalanche.

Separately, Tronscan transaction data show a 20.59 million TRX payment into the TRON recipient identified by Bitget. In an earlier nine-asset breakdown, Lookonchain valued the XRP at about $157.48 million and the ETH at $85.75 million, the two largest parts. That breakdown included TRX but no ZEC.

The transfer quantities count assets as they arrived. They do not include later swaps or transfers between attacker wallets, and the sender labels come from blockchain explorers.

Where the funds were moved next

The first receiving wallets no longer hold most of those assets. XRPSCAN shows the XRP recipient sent four payments of 20 million XRP and another payment of about 22.98 million XRP to five other addresses on Sept. 24. Its displayed balance was about 3.09 XRP when checked on Sept. 25.

Etherscan shows two outgoing transfers of 10,000 ETH each from the first Ethereum recipient, which held less than 0.01 ETH when checked. Arkham said the stablecoins and gold were being sold for ETH "within 10 minutes", and its tracing identified ether bridged from Arbitrum, Optimism and Base to Ethereum through Across, Stargate and LayerZero. In a Sept. 25 morning snapshot, Arkham reported roughly 68,300 ETH across eight fresh addresses.

Disputed wallet labels

Not everyone agrees on how the drained wallets should be described. Arkham described a drained XRP wallet as cold storage, meaning a wallet kept offline. Chen said a wallet that had been tagged as cold was actually a warm wallet, and repeated that cold wallets were secure.

What is confirmed

Bitget raised its estimate to about $387.5 million, up from $351.6 million, and said the change is extra accounting rather than a second incident. Withdrawals remain paused. The exchange says the vulnerability has been identified and fixed and that it is validating security before reopening withdrawals.

What is still unclear

Bitget's revised announcement lists ZEC among the affected assets but gives no per-token quantities or valuation schedule, so the exact dollar reconciliation is incomplete. The wallet classification disagreement between Arkham and Chen has not been resolved in the supplied material, and the claim that the User Protection Fund covers the incident comes from Bitget.

Why the pause matters

Withdrawals being paused means customers cannot move their assets off the exchange while security checks continue. The exchange has not said when the pause will end, and it has not committed to a reopening time.

What happens next

Chen said she would provide an update on withdrawal status and timing by midnight ET at the start of Sept. 26. That is a promised update, not a commitment to reopen withdrawals by then.

Sources

• The Defiant

Read also: Two New TIX Pools Drove 97% of Reported XRPL AMM Volume Without Holding XRP

Read also: Bitget suspends withdrawals after $351.6 million hot wallet breach