BTC $82,917 
ETH $2,656 
USDT $0.9997 
BNB $761.92 
XRP $1.49 
USDC $0.9998 
SOL $118.57 
TRX $0.3343 
ZEC $1,558 
FIGR_HELOC $1.06Bitget raises hack loss estimate to $387.5 million and sets withdrawal restart
Bitget puts losses at about $387.5 million, up from $351.6 million, and will reopen withdrawals in stages from September 28.
The short answer
Bitget suspended withdrawals after detecting unauthorized transfers from its hot-wallet infrastructure at 18:31 UTC on September 24. The exchange first estimated losses at $351.6 million and later put the figure at about $387.5 million, saying the higher number reflects additional Zcash and TRON transactions, not a second breach. Bitcoin withdrawals are scheduled to resume at 08:00 UTC on September 28, followed by ETH on September 29, USDT on September 30 and other services by October 2.
What happened
Bitget suspended withdrawals after detecting unauthorized transfers from part of its hot-wallet infrastructure at 18:31 UTC on September 24. The exchange first put losses at $351.6 million, then revised the value transferred to attacker-controlled addresses to approximately $387.5 million after including additional Zcash and TRON transactions. Bitget said the higher figure did not represent further unauthorized transfers.
Under the timetable, Bitcoin withdrawals resume first at 08:00 UTC on September 28. ETH withdrawals across several supported networks are due to follow on September 29, USDT on September 30, and other tokens, fiat and peer-to-peer services by October 2.
The exchange says its security team identified the attack path and the method used to bypass existing controls, and that it has remediated the vulnerability behind the incident. Mandiant and SlowMist are taking part in the investigation.
Why it matters
The revised figure makes the incident larger than the first estimate suggested. Bitget has maintained that customer account balances remain intact and that its protection arrangements cover the financial impact, and the staged restart is where that assurance gets tested in practice.
The restart spreads services across several dates and by asset category instead of switching every withdrawal function back on at once. Bitcoin returns four days after the incident was detected.
The affected assets sit across Ethereum and other EVM chains, XRP Ledger, Zcash and TRON, so tracing and recovery work spans several networks. Bitget has launched a recovery bounty program and says some funds have already been frozen through coordination with industry partners.
What is still unclear
- Bitget published the withdrawal dates in a September 26 support update that did not say whether individual withdrawal limits or other conditions would apply as services return.
- No further findings from Mandiant or SlowMist were detailed in the September 26 update, and the remediation statement is the exchange's own assessment.
- It is not yet clear how much of the $387.5 million will be frozen or recovered through the bounty program, or how the bounty will be paid out.
- Bitget describes hot wallets as connected to the internet for operational transfers, which is the part of its infrastructure it says was affected.
Questions readers ask
How much was taken in the Bitget hack?
Bitget initially estimated losses at $351.6 million. It later revised the value transferred to attacker-controlled addresses to approximately $387.5 million after including additional Zcash and TRON transactions.
When will Bitget withdrawals resume?
Bitget scheduled Bitcoin withdrawals to return at 08:00 UTC on September 28, followed by ETH on September 29 and USDT on September 30. Other tokens, fiat withdrawals and P2P services are planned for October 2.
Was there a second Bitget hack?
Bitget said the higher figure did not represent further unauthorized transfers. It described the change as a reassessment of the September 24 incident rather than disclosure of another breach.
Were Bitget cold wallets and Bitget Wallet affected?
Bitget said its cold wallets remained secure in a Support Center notice published with its first estimate. Mandiant and SlowMist are participating in the investigation.
Sources
- 1 NewsBTCBitget Raises Hack Estimate To $387.5M And Sets Withdrawal Restart Plan · 27 Sep, 00:30 UTC
- 2 Crypto DailyBitget Schedules Phased Bitcoin Withdrawal Restart After $387.5M Wallet Breach · 28 Sep, 09:01 UTC
- 3 UnchainedBitget Reopens Bitcoin Withdrawals, Starting Phased Restart After $388 Million Hack · 28 Sep, 10:18 UTC
- 4 Crypto.newsBitget resumes BTC withdrawals after $388M hack · 28 Sep, 10:33 UTC
