Major Exchange hack losses reach $387M

TLDR

Hackers stole roughly $387.5 million in crypto from Bitget, a major exchange, in one of the largest centralized exchange hacks on record.

1. Bitget revised its loss estimate to about $387.5 million, mostly from hot and warm wallets, while saying user balances will be covered.
2. The attack exploited Bitgets backend authorization systems rather than stealing private keys, highlighting a different kind of centralized exchange risk.
3. Withdrawals remain paused as Bitget, law enforcement, and security firms investigate and pursue asset freezes and bounties, with further recovery and regulatory fallout still developing.

Deep Dive

1. Losses And Coverage

Bitget initially estimated about $351.6 million in unauthorized transfers, then raised the figure to approximately $387.5 million after including Zcash (ZEC) and TRON (TRX) assets that early on-chain tallies missed.

The affected funds were held in hot and warm wallets used for day to day operations; Bitget states that its offline cold wallets remain intact and that no further unauthorized transfers are possible after patching the vulnerability.

The exchange says its dedicated User Protection Fund, valued at over $464 million, will fully cover customer balances, although that fund could be largely consumed unless significant amounts are recovered or frozen.

2. How The Hack Worked And Why It Matters

According to Bitgets incident updates, attackers compromised a critical backend system that manages wallet operations, fed in fraudulent transaction data, and got Bitgets own authorization process to approve transfers, rather than stealing keys or forging individual user withdrawal requests.

Reports describe large, fast trades where tens of millions in stablecoins were converted to ETH at a premium, then spread across multiple chains including Ethereum, XRP Ledger, TRON, and Zcash, consistent with sophisticated laundering patterns linked in past cases to North Korean groups - though attribution here remains unconfirmed.

Stablecoin issuers like Circle and Tether have frozen some exploit linked addresses, blocking a small slice of USDC and USDT, but the bulk of funds that have already been converted to assets like ETH remain outside issuer control, underscoring the limits of freeze functions as a recovery tool.

3. Recovery Efforts And What To Watch

Bitget has launched a recovery bounty program, offering 5 percent of assets frozen or recovered to cooperating exchanges, projects, and researchers, while coordinating with firms such as Mandiant and SlowMist on forensic tracing and remediation.

Withdrawals are paused pending a formal restoration plan, and further updates will clarify how much of the stolen crypto can be frozen or clawed back and how quickly the protection fund and other reserves are used or replenished.

For the broader market, this hack is likely to intensify scrutiny of centralized exchanges backend security, protection fund sizing, and incident response, which can influence where users feel comfortable holding custodial balances.

Conclusion

Bitgets breach shows that even well known exchanges can lose hundreds of millions without a simple key theft, through failures in internal authorization systems.

If Bitget truly makes customers whole from its protection fund and reserves, user facing damage may be limited, but the episode raises deeper questions about centralized risk, recovery mechanics, and how regulators and users will evaluate exchange security going forward.