TLDR
Bitget, a major centralized exchange, was hacked for about $387.5 million and is now offering sizable bounties to freeze and recover the stolen crypto.
- Bitgets breach involved hot and warm wallets across multiple chains, with losses revised to roughly $387.5 million after including Zcash and TRON assets.
- The exchange launched a Recovery Bounty Program paying 5% of any funds that helpers freeze and another 5% of any funds they actually recover.
- User balances are currently stated as covered by Bitgets protection fund, but the final impact depends on how much can be frozen or clawed back and how quickly operations normalize.
Deep Dive
1. What Happened In The Hack
Bitget reported unauthorized transfers from some hot and warm wallets on 24 Sep, affecting assets like XRP, Ethereum (ETH), Tether (USDT), USD Coin (USDC), Zcash (ZEC), Avalanche (AVAX), TRON (TRX) and others across EVM networks, XRP Ledger, Zcash and TRON.
Subsequent tracing raised the estimated loss from $351.6 million to about $387.5 million as additional ZEC and TRX transfers were included, with the exchange stressing this reflects fuller accounting rather than a new wave of thefts. Sources including Cointelegraph and CryptoSlate report that cold wallets were not compromised and that the exploited backend vulnerability has been patched.
Investigators from firms such as Mandiant and SlowMist are assisting, and there are unconfirmed indications that a North Korea linked group could be involved, consistent with past large exchange hacks.
This was a top tier size incident focused on hot infrastructure, not a full collapse, but it highlights that centralized custody remains a meaningful single point of failure.
2. How The Recovery Bounty Works
Bitget has launched a Recovery Bounty Program that directly ties rewards to results. Eligible participants can receive:
- 5% of the value of attacker funds they help get frozen at another venue or by an issuer.
- An additional 5% of the value of funds they help actually recover and return.
The bounty covers voluntary actions only; steps taken under court orders or law enforcement requests do not qualify, according to reports from crypto.news and a CoinsKid community brief. Bitget has published attacker addresses, opened a tracing dashboard and is routing submissions through Bybits LazarusBounty platform, while issuers like Circle and Tether have already frozen about $318,000 in linked USDC and USDT.
Exchanges and researchers now have a financial incentive to cooperate, which can accelerate freezing and blacklisting of tainted funds, but payouts remain discretionary and conditioned on Bitgets assessment.
3. Impact On Users And Market
Bitget says customer balances are accurate and that its User Protection Fund, valued at over $464 million and backed by 5,500 BTC, will cover losses if needed, though analysis from Finance Magnates notes the hack could consume a large share of that fund.
Withdrawals were paused but are scheduled to resume in phases, with Bitcoin, Ethereum, stablecoins and then other assets coming back online over several days as security checks complete, per crypto.news. Trading and deposits have remained open, so market pricing for affected coins is driven more by sentiment around centralized exchange risk than by direct protocol level damage.
If you use Bitget, the main practical questions are how fast withdrawals normalize and how transparent compensation terms are; for the wider market, it reinforces the value of diversified custody and venue risk management.
Conclusion
A large hot wallet breach at Bitget has triggered one of the more aggressive recovery bounty campaigns seen on a major exchange, aligning third party incentives to track and freeze stolen funds.
Whether this model becomes a template will depend on how much of the roughly $387.5 million loss can be clawed back and how smoothly Bitget honors user balances while restoring normal operations.
CoinsKid.Com