Bitget’s hack loss estimate rises to $387.5 million and a bounty program is launched

Bitget announced on September 25 that the total value of assets taken in its September 24 security breach has risen to $387.5 million, up from the previously reported $351.6 million. The increase reflects the inclusion of Zcash and TRON tokens that were missed in the initial accounting.

Updated loss estimate

CEO Gracy Chen said the higher figure represents transfers that occurred during the original incident and that no further unauthorized transactions have been detected. The exchange continues its investigation with blockchain security firms Mandiant and SlowMist.

Response and recovery efforts

Bitget has frozen some of the stolen assets in coordination with other exchanges and security firms, though the exact amount frozen has not been disclosed. Binance and Bybit have publicly pledged support. Bybit will update its LazarusBounty platform to help track the funds.

To aid the recovery, Bitget launched a real‑time tracing dashboard, a reporting portal and an API that lists attacker addresses for use by exchanges, stablecoin issuers, bridges and other infrastructure providers.

Recovery bounty program

• 5 % of any assets voluntarily frozen by eligible participants will be paid as a bounty.
• 5 % of assets successfully recovered through voluntary efforts will also be rewarded.
• Freezes that occurred before the program’s announcement may also qualify.
• Actions taken under court orders or law‑enforcement directives are excluded.

Customer withdrawals

Withdrawals remain suspended while Bitget validates its remediated systems. The exchange said it will publish a withdrawal plan by September 26 at 04:00 UTC, though it did not guarantee that withdrawals will resume at that time. Deposits and trading continue to operate.

Financial protection

Bitget’s User Protection Fund, which held over $464 million at the time of the breach, is intended to cover customer losses. The ultimate impact on the fund will depend on how much of the $387.5 million can be recovered through the bounty and partner efforts.