Major Exchange hack losses reach $387.5M

TLDR

Crypto exchange Bitget has confirmed a security breach with losses now estimated at about $387.5 million in digital assets.

1. Attackers compromised Bitgets wallet backend, triggering fraudulent transfers from hot and warm wallets across several networks, later tallied at roughly $387.5 million.
2. Bitget says customer balances will be fully covered via its User Protection Fund and a recovery bounty program, while withdrawals resume in stages.
3. The incident highlights growing risks from backend authorization exploits, partial stablecoin freezes, and suspected state-linked hacking activity for the wider crypto ecosystem.

Deep Dive

1. Scale And Mechanics Of The Breach

Bitget reports that approximately $387.5 million were moved to attacker-controlled addresses after a security incident detected on 24 Sep at 18:31 UTC. Initial estimates of $351.6 million were revised upward once Zcash and TRON balances were included.

According to Bitgets CEO Gracy Chen and multiple reports, attackers did not steal private keys. Instead, they compromised a backend system managing wallet operations and spoofed transaction data so the exchanges own authorization process approved fraudulent transfers that looked legitimate internally.

Assets impacted span Ethereum and other EVM chains, XRP Ledger, Zcash and TRON, with stolen coins including XRP, ETH, USDT, USDC, BNB, AVAX, TRX and ZEC. Cold wallets remained intact, and Bitget kept trading and deposits live while suspending withdrawals.

2. Coverage, Fund Strain, And Bounties

Bitget states that its User Protection Fund, holding 5,500 BTC and valued at over $464 million at disclosure, will fully cover user losses. Customers account balances are said to remain accurate despite the asset drain.

Analyses suggest the revised loss equals roughly 8384 percent of the funds stated value, meaning most of the reserve could be consumed if recovery is limited. Bitget has launched a recovery bounty paying 5 percent of frozen assets and 5 percent of returned assets, and is coordinating with other exchanges and security firms through Bybits LazarusBounty platform.

Withdrawals are set to reopen gradually, starting with Bitcoin and then major assets like ETH and USDT over several days, following additional security checks.

3. Wider Security And Regulatory Implications

Stablecoin issuers Circle and Tether quickly froze about $318,000 linked to an exploiter wallet, illustrating how centralized controls can limit some damage but cannot stop movement of native assets like ETH. Most stolen funds remain unrecovered.

Investigators and Bitgets CEO have flagged IP and on-chain patterns consistent with North Korean groups such as Lazarus, though attribution is still unconfirmed and under law-enforcement review. The method, focused on backend authorization rather than key theft, echoes past high-profile exchange incidents.

For other platforms, this raises the stakes on hardening internal approval workflows, monitoring automated wallet systems and planning for post-breach user protection funding rather than relying solely on perimeter or key security.

Confidence: high, because multiple independent reports and Bitgets own statements converge on the loss size, mechanism and coverage plan.

Conclusion

Bitgets $387.5 million hack is one of the largest exchange breaches to date and shows that sophisticated attackers now target internal wallet logic, not just private keys. While Bitgets protection fund and bounty program aim to shield users, the episode underscores that exchange risk includes both technical controls and how well platforms can absorb and recover from a major loss. Watching withdrawal timelines, recovery progress and any confirmed attribution will be important for assessing both Bitgets resilience and broader industry security standards.