Major Exchange hack losses hit $387M

TLDR

Crypto exchange Bitget has confirmed hackers stole about $387.5 million from its wallets, revising earlier estimates as forensics reveal the full scope of a major security breach.

1. Bitget now says roughly $387.5 million was drained from hot and warm wallets after a backend wallet system was compromised, while cold storage remained intact.
2. The exchanges User Protection Fund of more than $464 million is covering all losses, but withdrawals are still paused as investigations and recovery efforts continue.
3. Suspected North Korea-linked actors and the use of multi-chain swaps highlight growing state-grade threats and the limits of stablecoin freezes, a key risk for all centralized exchanges.

Deep Dive

1. What Happened At Bitget

Bitget has updated its incident report to confirm that about $387.5 million in assets was transferred to attacker-controlled addresses during a 24 September breach, up from an initial estimate of $351.6 million, after adding Zcash and TRON that were missed in early totals, and stressing that this is not new theft but better accounting of the same incident.Bitget clarifies $388M in assets affected by security breach

The attack targeted Bitgets backend wallet infrastructure, where attackers spoofed transaction data and tricked the exchanges own authorization system into approving fraudulent transfers, rather than stealing private keys or forging user withdrawal requests.Bitget Hack Timeline

Stolen assets spanned Ethereum Virtual Machine networks, the XRP Ledger, Zcash and TRON, including large amounts of XRP, ETH, USDT, USDC, ZEC, BNB, AVAX and TRX.Bitget hack details

2. User Impact And Coverage

Bitget says user account balances remain accurate because the entire loss falls inside its User Protection Fund, which held over $464 million at the time of the breach, allowing the exchange to absorb the damage on its own balance sheet.Bitget raises breach estimate to $387.5M

Trading and deposits continue to operate, but withdrawals are paused while security teams complete remediation and forensics, with Bitget committing to publish a withdrawal plan once the environment is deemed safe.

Circle and Tether have frozen around $318,000 in USDC and USDT at one exploit-linked address, but the attacker rapidly converted most stablecoins into ETH, which cannot be frozen at contract level, leaving the vast majority of funds unrecovered so far.Circle and Tether freeze stablecoins tied to Bitget hack

3. Recovery Efforts, Attribution And Broader Risk

Bitget has fixed the identified vulnerability and launched a recovery bounty program, offering 5 percent rewards on assets frozen or retrieved, and is working with firms like Mandiant, SlowMist and other exchanges to trace and claw back funds.Bitget raises breach estimate to $387.5M

CEO Gracy Chen has said IP patterns and on-chain behavior resemble previous operations by North Koreas Lazarus Group, and several reports describe North Korea-linked hackers as likely culprits, but formal attribution by law enforcement is still pending.Bitget Hack Losses Climb to $387M

For the wider market, this incident joins recent large exchange and protocol exploits, reinforcing three structural risks: complex internal wallet systems, cross-chain liquidity paths that speed laundering, and reliance on centralized funds and issuers to mitigate damage.

Conclusion

Bitgets breach is one of the largest exchange hacks on record, with losses now tallied around $387.5 million but fully covered by a sizable protection fund. The event appears contained, yet it highlights how sophisticated attackers can exploit backend systems without touching private keys and how quickly stolen assets can escape beyond the reach of stablecoin freezes. Going forward, the key signals are Bitgets withdrawal restart, any confirmed attribution, and whether other exchanges harden similar wallet infrastructure before the next state-grade attack tests the system again.