Bitget raises breach loss estimate to $387.5 million and offers bounty

Bitget raised its estimated loss from the Sept. 24 breach to $387.5 million. The previous estimate was $351.6 million. Gracy Chen said further on-chain tracing identified Zcash and TRON assets excluded from Bitget's initial accounting. Chen said transfers made during the original incident caused the increase. She said no additional unauthorized transactions had occurred. Bitget's investigation with Mandiant and SlowMist remains underway. Bitget first detected unauthorized transfers from some hot wallets at 18:31 UTC on Sept. 24. Bitget suspended withdrawals after detecting the transfers. Deposits and trading remained operational. Bitget said its security team identified and patched the underlying vulnerability. Bitget said it froze some affected assets with industry partners. Bitget has not disclosed the value of those assets. Bybit Chief Executive Officer Ben Zhou said Bybit would assist Bitget. Bybit plans to update its LazarusBounty platform to track the stolen funds. Bitget said it would use LazarusBounty as a main recovery channel. Bitget also published a tracing dashboard, a reporting portal and an API containing attacker addresses. The tools allow exchanges, stablecoin issuers, bridges and other infrastructure providers to monitor the funds. Bitget launched a Recovery Bounty Program for eligible voluntary efforts. Parties that freeze stolen funds can receive 5% of the amount successfully frozen. Parties that recover stolen funds can receive 5% of the amount successfully recovered. Freezes secured before the program's announcement can qualify. Bitget will determine eligibility and bounty amounts. Actions taken under court orders, law enforcement requests or other compulsory legal processes are excluded. Withdrawals remained suspended more than a day after the breach. Chen said Bitget would announce its withdrawal plan by Sept. 26 at 04:00 UTC. Bitget did not say withdrawals would necessarily resume at that time. Technical teams were validating remediated systems and completing checks before withdrawals could safely resume. Bitget previously said customer balances remained accurate. Its User Protection Fund held more than $464 million when the incident was disclosed. Bitget said the fund covered losses. The revised estimate leaves about $76.5 million before recovered assets are considered.