Community Trust ScoreVerified
Bitget’s security nightmare just got bigger. The crypto exchange confirmed Thursday that roughly $387.5 million moved to hacker-controlled addresses — up from the $352 million figure it put out initially, a jump of about $35 million.
The revised number came after a more thorough sweep of asset movements across multiple blockchain networks. Two networks that didn’t appear in the first disclosure — Zcash and TRON — turned out to be part of the attack after all. So the original estimate was basically incomplete, and the updated figure now covers a wider range of affected wallets. Bitget said the breach has been contained and that no further unauthorized transfers are expected, though it’s worth noting the exchange didn’t spell out exactly when or how that containment happened. No details there.
The stolen haul was diverse. We’re talking XRP, Ether, Tether’s USDT, Zcash, USDC, XAUt, BNB, AVAX, and TRX — a wide mix that cuts across EVM-compatible chains, the XRP Ledger, Zcash, and TRON. That kind of spread across different network architectures makes tracing funds harder. Each chain runs its own rules, its own block explorers, its own recovery playbook.
Withdrawals Frozen, Bounty Program Launched
Bitget moved fast on two fronts. The exchange paused all withdrawals to stop the bleeding, and it rolled out a bounty program aimed at freezing or recovering the stolen assets. The bounty play is pretty standard at this point — exchanges hit by major breaches have used similar tactics before, with mixed results. Whether it works here depends on how quickly blockchain analytics firms can track the funds before they get laundered through mixers or converted.
Bitget’s decision to halt withdrawals is the kind of call that frustrates users short-term but probably prevents further damage. It’s a hard trade-off, and the exchange seems to have made it quickly. No word yet on when withdrawals will resume or what conditions need to be met first.
The investigation is still live. Bitget hasn’t shared whether any leads have been established, whether law enforcement has been looped in formally, or what the bounty program has produced so far. Unclear.
North Korea Angle Left Hanging
Here’s where it gets murky. Bitget CEO Gracy Chen apparently floated the idea that a North Korean hacking group might be behind the attack. The exchange’s updated incident report, though, didn’t address that speculation directly. Chen’s suggestion wasn’t walked back, but it wasn’t confirmed either. It’s just sitting there.
North Korean state-linked hackers — particularly the Lazarus Group — have been tied to some of the biggest crypto thefts in recent years. The pattern of targeting major exchanges and moving funds rapidly across chains fits their known methods. But Bitget hasn’t officially attributed the breach to any group, and it’s probably too early to say with confidence who’s responsible.
What’s clear is the scale puts Bitget’s breach among the worst in recent crypto history. The only one that tops it from the past couple of years is the Bybit hack in February 2025, when attackers walked off with approximately $1.5 billion in Ether. That one shook the industry hard. Bitget’s breach, at $387.5 million, sits well below Bybit’s record but still ranks as a serious hit.
What the Asset List Says About the Attack
The range of stolen tokens is worth sitting with for a second. Attackers grabbed not just liquid majors like ETH and XRP but also stablecoins — USDT and USDC — which are easier to move and harder to freeze once they’ve jumped chains. XAUt, a gold-backed token, was also in the mix. So was TRX, which runs on TRON, one of the two networks that weren’t in the original disclosure.
That TRON and Zcash showed up only in the revised report probably means the initial forensic sweep missed activity on those chains. Zcash in particular has privacy features that can complicate tracking. If any portion of the stolen ZEC got shielded, recovery gets significantly harder.
Bitget said it’s working to recover affected assets and secure the platform. The exchange is engaging cybersecurity experts, though it hasn’t named any firms publicly. It’s also not clear whether affected users will be compensated directly or whether any insurance or reserve fund covers losses of this size.
The exchange’s broader security review is ongoing. Bitget said it’s looking at vulnerabilities across its systems, but specifics on what failed in the first place haven’t been shared. Users are waiting.
And the broader crypto industry is watching too. Bybit’s $1.5 billion breach earlier in 2025 was supposed to be a wake-up call. Bitget’s breach — coming months later, hitting a different exchange, across multiple chains — shows the threat didn’t go away. It adapted.
The bounty program is live. Withdrawals remain paused. And $387.5 million is still, mostly, missing.
Hub: USDC price, news, and analysis
Frequently Asked Questions
How much was stolen in the Bitget security breach?
Bitget confirmed approximately $387.5 million in assets moved to hacker-controlled addresses, up from an initial estimate of $352 million after Zcash and TRON activity was factored in.
Which cryptocurrencies were taken in the Bitget hack?
Stolen assets included XRP, Ether, USDT, Zcash, USDC, XAUt, BNB, AVAX, and TRX, spread across EVM networks, the XRP Ledger, Zcash, and TRON.
Why It Matters
The significant increase in the estimated losses from the Bitget breach underscores the vulnerabilities that still permeate the crypto exchange landscape, potentially undermining investor confidence. As more assets from networks like Zcash and TRON are identified as part of the breach, it highlights the necessity for exchanges to enhance their security protocols in a market that is already grappling with regulatory scrutiny and investor wariness. This incident may prompt a broader reassessment of risk management practices across the industry, influencing trading behaviors and the overall market sentiment.
