Bitget Raises Hack Estimate to $387.5M, 83.5% of Protection Fund
Bitget has raised its estimate of the assets moved to attacker-controlled addresses from $351.6 million to $387.5 million, after adding transfers on Zcash and TRON that were omitted from its first tally, according to
· 4 min read
Bitget has raised its estimate of the assets moved to attacker-controlled addresses from $351.6 million to $387.5 million, after adding transfers on Zcash and TRON that were omitted from its first tally, according to Financemagnates. At the revised figure, the loss would absorb about 83.5% of the exchange’s User Protection Fund, which Bitget values at more than $464 million.
The exchange disclosed the breach on September 24, 2026, saying its security systems detected unauthorized transfers from some hot wallets at 18:31 UTC. CEO Gracy Chen said in a post on X that emergency response protocols were activated immediately. Cointribune reported that initial on-chain alerts from Arkham and other analysts put the loss near $228 million in the first 18 minutes, and that Bitget had already begun by announcing a $351.6 million figure before the September 25 revision.
Also read: Bitcoin Falls 4% as Crypto Stocks Slide on Stalled US Regulation Bill
Key facts
- The revised loss figure is $387.5 million, up from the first announced $351.6 million, with the added transfers made on Zcash and TRON.
- The User Protection Fund holds 5,500 Bitcoin and was valued at more than $464 million; it averaged $382 million in August, ranging from $345.3 million to $441.5 million.
- Affected assets include XRP, ETH, USDT, ZEC, USDC, USDT0, XAUt, BNB, AVAX and TRX, according to Cointribune, which also reported that no new unauthorized movements have been recorded since the incident was contained.
- Mandiant and SlowMist are assisting the investigation, and a bounty offers eligible participants 5% of assets they help freeze or recover, excluding actions taken under court orders or law-enforcement requests.
- Coinpedia reported that the Bitget event is the largest crypto hack of 2026 so far, ahead of the $320 million Liquid Network exploit and the $292 million KeloDAO hack.
How the breach worked
Bitget said the hacker compromised a critical backend component responsible for managing exchange wallets and falsified transaction data to trigger the internal authorization process. Chen said private keys were not compromised, which rules out direct key theft and points instead to the infrastructure that prepares and approves transfers. The affected infrastructure covered part of the exchange’s hot and warm wallets; cold wallets were unaffected, as was the self-custody Bitget Wallet product.
Cointribune reported that the hacker converted part of the assets from Ethereum-compatible networks. Lookonchain estimated 67,982 ETH, worth roughly $183 million, was obtained after routing through several exchanges. Deposits and trading continued while withdrawals stayed suspended during security checks. Bitget said it identified the attack path and fixed the underlying vulnerability and that no further unauthorized transfers are possible.
Also read: Bitcoin Jumps 5% as SEC Advances Digital Securities Plan
Fund mechanics and limits
The fund, set up in 2022 to cover hack losses, is separate from the reserves backing customer balances and is held entirely in Bitcoin, so its dollar value moves with the cryptocurrency. The repair math is provisional: frozen or recovered assets could lower what the fund ultimately has to absorb. Bitget has not disclosed the value of assets already frozen, the compensation schedule, or how quickly it would rebuild the reserve, and it has not said how any payouts would be split between the fund and its own holdings, though Chen said the company holds more than $1 billion of its own assets.
Unlike South Korea, which requires virtual asset providers to insure or hold reserves equal to at least 5% of customer assets kept outside cold wallets, there is no single international standard for voluntary exchange protection funds. That benchmark cannot be applied to Bitget directly because the exchange does not publish how much customer money sits in hot and warm wallets. Binance’s SAFU reserve, also held in Bitcoin, is valued at roughly $1 billion.
Why it matters
Bitget users are watching a fund whose coverage is asserted rather than audited against disclosed wallet exposure, and its dollar value can fall with Bitcoin before any reimbursement is settled. The credited outlets also differ on the loss total: Cointribune traces a path from an on-chain $228 million estimate to the current $387.5 million, while Coinpedia’s September 25 report used the earlier $351.6 million. Chen provisionally attributed the operation to North Korean hackers based on IP addresses and methods, an attribution Cointribune noted has not been publicly confirmed by an independent authority.
What to watch
Bitget was due to announce the status and timing of restored withdrawals by 04:00 UTC on September 26, 2026. The rest depends on how much of the $387.5 million is actually frozen or recovered.
Sources: Finance Magnates, Cointribune, Coinpedia
Emily Torres covers cryptocurrency and decentralized finance for StockPil, tracking blockchain markets and regulatory developments.
More from Emily →