Bitget Says Recovery Of $388M Breach Funds May be Limited

Bitget says it does not expect to recover a large share of the $387.5 million stolen in its Sept. 24 security breach, even as exchanges, stablecoin issuers and blockchain teams continue tracing and freezing attacker-linked funds.

During a Sept. 28 livestream led by CEO Gracy Chen, Bitget Greater China head Xie Jiayin said the exchange was “not that optimistic” about recovering a significant portion of the assets. He pointed to previous exchange hacks where only a small share was frozen or returned after months of tracing.

Bitget Says Recovery Of $388M Breach Funds May be Limited

Bitget has opened a recovery bounty program that pays 5% of funds directly frozen through a participant’s assistance and another 5% for assets that are successfully returned.

The exchange has published attacker addresses, a tracking dashboard and an information submission portal to support recovery efforts.

Tether and Circle had frozen about $318,000 linked to the breach by Sept. 26. Bitget has not published a verified total for all assets frozen or recovered and says confirmed figures will be released once available.

Third-Party Security Flaw Led to $387.5M Loss

Bitget says the attacker exploited a vulnerability in a third-party security product to obtain high-level internal credentials. Those credentials were then used to forge withdrawal instructions that passed through the exchange’s wallet infrastructure.

The exchange says its private keys were not compromised, and its cold wallets were unaffected. The stolen amount was revised from $351.6 million to $387.5 million after Bitget added previously uncounted Zcash and TRON transfers. Mandiant and SlowMist are assisting with the forensic investigation.

Bitcoin Withdrawals Resume as Recovery Efforts Continue

Bitget resumed Bitcoin withdrawals on Sept. 28 and scheduled Ether withdrawals for Sept. 29, USDT for Sept. 30, and other tokens, fiat withdrawals and peer-to-peer services for Oct. 2.

The exchange says the exploited vulnerability has been fixed and that no further unauthorized transfers are possible.

Bitget is covering the financial loss through its User Protection Fund, which held more than $464 million after the incident. The company has said it will keep the fund above $300 million and replenish it using company reserves.

Tracing efforts will continue even if recovery remains limited. Bitget is asking exchanges, stablecoin issuers and cross-chain protocols to monitor the published addresses and restrict cash-out routes where technically possible.