Bitget Raises Hack Loss Estimate to $387.5 Million as XRP Takes Biggest Hit

A Forged Approval, Not a Stolen Key

Crypto exchange Bitget confirmed on September 25 that unauthorized transfers had drained roughly $351.6 million in digital assets from wallets under its control. Per the exchange's official security notice, no private keys were stolen: the attacker infiltrated a critical backend system underpinning Bitget's wallet infrastructure, falsified transfer data, and pushed forged payout instructions through Bitget's own approval process. The breach hit part of the hot and warm wallet layers, while cold storage remained untouched. The stolen funds spanned several chains and assets, including Ethereum, XRP, BNB, USDT and USDC. Deposits and trading continued normally, but withdrawals were frozen pending security verification — a suspension still in force at publication time. Bitget's monitoring flagged the abnormal outflow at 18:31 UTC on September 24, and CEO Gracy Chen issued the first public alert within hours, committing the company to covering assessed losses in full through its user protection fund and ruling out insider involvement.

A 5,500 BTC Backstop

The backstop for user losses is Bitget's protection fund, which holds 5,500 BTC — an allocation worth roughly $461 million at the current Bitcoin price near $84,000. That buffer covers the confirmed loss today, but it is price-dependent: arithmetic on the fund's size shows its valuation would fall short of the $351.6 million initial loss if Bitcoin dropped below roughly $63,900. That is not a hypothetical floor — the fund's own August report showed its value sliding to about $345.3 million when Bitcoin traded near $62,800 earlier in the month, below the current loss figure. The fund has also shrunk: it held 6,500 BTC in July 2025 before declining to the present 5,500 BTC, with no public explanation for the 1,000 BTC reduction. Bitget has not specified whether it will sell fund Bitcoin or absorb the loss from equity, and the episode is renewing interest in self-custodial setups such as Tangem Pay that keep keys with the user.

North Korea Trail and Frozen Stablecoins

The attribution trail points toward North Korea, though nothing is officially confirmed. Chen said the initial security investigation identified IP addresses matching a virtual private network favored by a specific North Korean group, and Bitget's 12-hour report described the indicators as highly consistent with known DPRK hacker tradecraft, with the case reported to authorities. No group has been named. On-chain researchers surfaced parallel links: part of the stolen XRP was traced to an Ethereum address that had received 68,808 USDT from a wallet previously labeled AFX Exploiter — AFX lost $24 million in a July hack it attributed to the TraderTraitor cluster. Issuers moved on the stablecoin side: Circle blacklisted an address tagged “Bitget Exploiter 8” holding 170.47 ETH, 218,023 USDT and 99,990 USDC, and Tether blocked the same wallet, freezing about $318,000 in stablecoins. Attacker wallets still hold more than 63,000 ETH after stolen stablecoins were swapped into ETH within minutes on DeFi venues — paying up to 5% over market for speed — and BNB and ETH were routed into Bitcoin via no-KYC cross-chain services of the kind that move wrapped Bitcoin between networks.

Tally Revised to $387.5 Million

The loss figure itself is still moving. In an update posted on X, Xie Jiayin, Bitget's executive responsible for the Chinese-speaking region, said on-chain tracking now puts assets moved to attacker addresses at approximately $387.5 million — up from the initial $351.6 million estimate after ZEC and TRX were added to the tally. Bitget said no further unauthorized transfers have been identified beyond those assets. The security team has largely determined the attack path and the techniques used, including how the attacker bypassed internal security controls, though the investigation is not complete: third-party reviews by Mandiant and SlowMist remain ongoing, and a final technical report is expected once they finish. Bitget also launched a recovery incentive, offering a 5% bounty on any recovered amount to parties whose cooperation helps freeze or reclaim stolen funds — a mechanism with early traction, as Chen has confirmed some stolen assets were already recovered, without disclosing the amount. Readers tracking the market in real time can follow live spot and futures prices on Gate.

Xhttps://x.com/xiejiayinBitget/status/2103497298655547608

Recovery Hinges on the Technical Report

COINOTAG's reading of the on-chain record shows how much the post-mortem has already settled. The outflow began with a 0.84 ETH test transfer from the labeled hot wallet, and the largest single movement — roughly 91.42 million XRP on the XRP Ledger — is independently verifiable on-chain, matching the official tally. The team's post-mortem to date pins the root cause on a compromised backend generating fraudulent transfer data rather than key theft, with remediation centered on the withdrawal freeze, the protection-fund guarantee and the 5% bounty. The open question is the 63,000-plus ETH still parked in attacker wallets: whether the market absorbs that overhang without becoming their exit liquidity, and how the promised 24-hour report and final technical report land. Traders reassessing counterparty risk can start with our guide to the best crypto exchanges.