Major Exchange hack losses reach $387M

TLDR

Hackers stole about $387.5 million from Bitget in one of this years largest centralized exchange breaches, with losses concentrated in hot and warm wallets.

1. Bitget reports $387.5 million was drained from its exchange wallets after attackers abused its internal wallet-authorization system, not by stealing private keys.
2. The incident hit XRP, ETH, stablecoins, TRON, Zcash and others, but Bitget says its $464 million User Protection Fund will cover customer balances while withdrawals remain paused.
3. Stablecoin issuers froze only a tiny slice of funds, and Bitget has launched bounty and recovery programs, highlighting ongoing systemic risk around centralized exchanges and backend security.

Confidence: high - multiple independent reports and Bitgets own updates align on the core figures and mechanism.

Deep Dive

1. What Happened And How Big It Is

Bitget has confirmed that attackers stole about $387.5 million from its exchange wallets in a security incident detected on 24 September, making it one of the largest crypto exchange hacks of the year. Reports from several outlets describe how the breach began with unauthorized transfers from Bitgets hot and warm wallets, with initial loss estimates around $351.6 million before being revised up as additional Zcash and TRON movements were included in the total.

According to Bitgets incident description, the attackers compromised a critical backend system that manages wallet operations and fed it falsified transaction data, tricking the exchanges own authorization process into approving outgoing transfers, rather than directly stealing private keys. This pattern is consistent across multiple detailed breakdowns of the incident.

2. User Impact, Assets And Coverage

Bitget says the stolen assets span multiple networks, including XRP, Ether (ETH), Tethers USDt (USDT), USDC, TRON (TRX), Zcash (ZEC), and others, with cold wallets reported as unaffected in its incident update. The exchange has paused withdrawals but kept deposits and trading open while investigations and remediation continue.

Bitget states that customer balances will be made whole from its User Protection Fund, which it valued at over $464 million, and that the revised $387.5 million figure represents assets moved into attacker-controlled addresses during the breach rather than new ongoing drain. Some analysts note this could consume more than 80 percent of that fund, implying that Bitget will likely need to replenish reserves after compensating users.

3. Recovery Efforts And Wider Lessons

Stablecoin issuers Circle and Tether have frozen around $318,000 in USDC and USDT connected to a wallet implicated in the hack, a tiny fraction of the total, while roughly 63,000 ETH and other assets remain under attacker control according to blockchain trackers. Bitget has introduced an asset-recovery bounty program, offering a percentage reward on frozen or returned funds, and is working with security firms Mandiant and SlowMist plus other exchanges to trace and block stolen tokens.

Bitgets CEO has said on-chain and IP patterns resemble prior North Korealinked campaigns, but attribution remains unconfirmed as law enforcement investigations continue. For users, this incident underscores that centralized exchanges are exposed not only at the key level but also through complex backend systems that can be tricked into signing off on fraudulent internal transfers.

Conclusion

The roughly $387.5 million Bitget breach shows how sophisticated attackers can exploit exchange infrastructure without directly stealing private keys, turning internal authorization flows against the platform. While Bitgets protection fund and recovery efforts reduce the odds of permanent user balance loss, the episode highlights ongoing structural risk around centralized exchange security and reinforces the value of venue diversification and careful use of custodial platforms.