Bitget puts losses from hot-wallet breach at $387.5 million

Bitget said its $387.5 million hack involved unauthorised transfers from some of its hot wallets on September 24. The cryptocurrency exchange paused customer withdrawals during a security review, leaving customers unable to move assets from the platform at the time of updates published on September 25 and 26.

The $387.5 million figure is Bitget’s latest estimate of assets affected by the incident, according to Finextra, Yellow and Bloomingbit. The supplied reports do not show an independent audit or a final loss figure.

Bitget initially put the amount at $351.6 million. Cointribune reported that an earlier on-chain estimate had put identifiable transfers at about $228 million. Bitget later raised its own estimate after including transfers on the Zcash and TRON networks that were omitted from its first calculation, Yellow reported. The revision therefore reflected a broader accounting of transfers, according to the company, rather than necessarily a further theft.

When will Bitget resume withdrawals?

Bitget said withdrawals were suspended as a precaution while it completed security checks, Finextra reported. In a September 25 update, the exchange said it would set out a plan for resuming withdrawals by 1 p.m. Korea Standard Time on September 26, according to Bloomingbit.

The reports in the available record do not confirm that withdrawals subsequently resumed. Bitget said customer account balances remained accurate and that customer assets were protected. It also said its cold wallets were secure. Those assurances are the company’s statements and are not independently established in the reports.

Why did Bitget change the estimated loss?

The incident estimate developed through three reported stages. Cointribune said early on-chain monitoring identified about $228 million in transfers. Bitget then reported $351.6 million, before revising the total to about $387.5 million after accounting for Zcash and TRON transfers, according to Yellow and Cointribune.

• Early on-chain estimate: about $228 million, according to Cointribune.
• Bitget’s initial estimate: $351.6 million, according to Finextra and Cointribune.
• Bitget’s updated estimate: about $387.5 million, according to Finextra, Yellow and Bloomingbit.

Bitget said it had launched a recovery bounty programme to help freeze and retrieve affected assets. Yellow reported that the exchange offered 5% of eligible funds voluntarily frozen or recovered. The company also said Mandiant and SlowMist were assisting its investigation, while Bloomingbit reported that Bitget planned to work with exchanges, blockchain projects, security researchers and investigative firms.

Chief executive Gracy Chen said the attack’s IP behaviour and on-chain signatures were consistent with methods used by groups linked to North Korea, Finextra reported. That is Bitget’s preliminary assessment. Cointribune said no independent authority had publicly confirmed the attribution in the available reporting.

This story draws on original reporting from Finextra Research.