Bitget has revised its accounting of losses from last week’s security breach, raising the figure tied to attacker-controlled addresses to $387.5 million—up from an earlier estimate of $352 million. The updated incident report, released Thursday and followed by another update Friday, also said the incident remains contained and that no further unauthorized transfers are possible.
The exchange reiterated that it will continue pausing withdrawals and said it has launched a bounty program intended to help freeze or recover affected assets. The key change in Bitget’s latest disclosure is a “more complete accounting” of transfers, including assets that were not included in the initial estimate.
Key takeaways
- Bitget updated its breach figures: $387.5 million was transferred to attacker-controlled addresses, not $352 million.
- The exchange said the revision reflects additional accounting of affected assets on Zcash and TRON, without indicating any new unauthorized activity.
- Withdrawals remain paused, while Bitget launched a bounty program aimed at freezing or recovering funds.
- Bitget reported involvement of multiple networks, including EVM chains, XRP Ledger, Zcash, and TRON.
What Bitget changed in its incident report
In its revised accounting, Bitget said that the updated figure comes from a fuller reconciliation of transfers that occurred during the incident. The exchange attributed the adjustment to affected assets on Zcash and TRON that were left out of the initial estimate, stating that the new number does not reflect further unauthorized transfers.
Bitget’s statement emphasized containment: the company said the incident remains contained and that “no further unauthorized transfers are possible.” For users watching the case, the practical implication is that the revision is about measurement and scope rather than evidence of an expanded compromise.
Withdrawals paused as attacker routing is traced on-chain
In its Friday update, Bitget confirmed it will continue pausing withdrawals. At the same time, the platform said it has launched a bounty program designed to incentivize efforts to freeze or recover the assets that were moved to addresses controlled by the attacker.
Bitget also pointed to on-chain tracing in explaining where funds went. According to the exchange, “$387.5 million were transferred to attacker-controlled addresses,” with the revised total about $35 million higher than the earlier number. In other words, the updated report is not just a re-phrasing of loss estimates—it is an adjustment tied to the mapping of those transfers to attacker-controlled endpoints.
Networks and assets implicated across the ecosystem
Bitget’s revised incident report lists multiple affected blockchain environments. The exchange said the incident involved addresses on Ethereum Virtual Machine (EVM) networks as well as the XRP Ledger, Zcash, and TRON.
The follow-up disclosure also enumerated several assets the attackers allegedly took. According to Bitget, stolen or affected assets included XRP, Ether (ETH), Tether’s USDt (USDT), Zcash (ZEC), USDC, USDT0, XAUt, BNB, AVAX, and TRX.
For investors and traders, the multi-network nature of the incident matters because it affects how quickly risk can be reduced. Different chains can require different monitoring, compliance processes, and—critically—different operational steps for exchanges trying to halt or limit withdrawals and protect hot and intermediate custody.
Broader industry context and what remains unclear
Even with the clarification on the corrected loss figure, Bitget’s security breach remains among the largest incidents to hit the industry. The article’s context highlights that hackers stole about $1.5 billion worth of Ether from Bybit in February 2025, underscoring how damaging major exchange compromises can be even when withdrawals are halted and funds are monitored.
Notably, Bitget’s later update did not directly address comments made by CEO Gracy Chen from Thursday. In earlier coverage, Chen speculated that a North Korean hacking group might be behind the attack, citing what she described as “IP clues.” The revised incident report, as presented in the update, focuses on accounting and containment rather than attributing the breach to a specific actor.
That leaves an important tension for readers: while the exchange’s updated figures aim to settle questions about scale, attribution and motive appear to remain separate and unresolved in Bitget’s latest public disclosures. As the bounty program ramps up and tracing work continues, additional information could emerge—either from on-chain evidence, coordination efforts to identify and freeze assets, or follow-on updates from the exchange.
For now, market participants should watch whether Bitget later provides more details on recovery efforts and the timeline for when withdrawals might resume, alongside any further revisions to affected totals. The updated numbers suggest the incident’s spread is better understood, but the path from attacker-controlled transfers to recoverable funds—and the question of who carried out the breach—will likely determine the next phase of this story.
