- Bitget has raised its confirmed loss estimate from $351.6 million to roughly $387.5 million in assets transferred to attacker-controlled addresses.
- The exchange says the underlying vulnerability has been identified and remediated, with Mandiant and SlowMist assisting the investigation.
- Withdrawals will restart in stages: Bitcoin on September 28, Ether on September 29, USDT on September 30, and other tokens, fiat and P2P by October 2.
- Affected assets span Ethereum and other EVM chains, XRP Ledger, Zcash and TRON; a recovery bounty program has been launched.
- Bitget maintains customer balances remain intact and that its protection arrangements cover the financial impact.
The Vulnerability Has Been Patched, Bitget Says
According to the exchange, its security team has now identified the attack path and the method used to bypass existing controls. Bitget says the underlying vulnerability has been remediated and that no further unauthorized transfers are possible. Independent teams from Mandiant and SlowMist are participating in the investigation, lending outside credibility to those claims at a moment when self-reported exchange security assessments tend to be viewed skeptically.
The revised loss estimate includes assets across multiple networks, including Ethereum and other EVM chains, XRP Ledger, Zcash and TRON. That multi-chain footprint complicates recovery, since frozen funds must be traced and coordinated across separate ecosystems and counterparties. Bitget has also launched a recovery bounty program. Eligible parties whose voluntary actions directly result in funds being frozen or recovered can receive a bounty calculated as a percentage of the assets secured. The exchange says some funds have already been frozen through coordination with industry partners.
Withdrawals Will Return In Stages
Bitget plans to reopen withdrawals gradually rather than turning everything back on at once. Bitcoin withdrawals are scheduled to resume first on September 28. Ether withdrawals across several supported networks are expected to follow on September 29, with USDT withdrawals scheduled for September 30. Other tokens, fiat services and peer-to-peer withdrawals are planned to return by October 2.
That timetable is now one of the most important operational tests following the breach. Bitget has maintained that customer account balances remain intact and that its protection arrangements cover the financial impact. Restoring withdrawals is where users get to test that assurance in practice. A staged reopening reduces the risk of a fresh run on reserves, but it also gives depositors several days to decide whether they want their funds back on the platform at all.
Market Context
The disclosure lands in a broadly constructive tape. Bitcoin is trading near $84,683, up 0.33% on the day, while Ethereum sits around $2,713, up 0.66%. XRP is changing hands near $1.53, up 0.41%. Those gains are modest, and the absence of a sharp risk-off move suggests traders are treating the Bitget incident as exchange-specific rather than systemic — at least for now.
The new $387.5 million figure also makes this a materially different story from the initial breach report. The incident itself has already been confirmed. Now the focus is shifting to remediation, asset recovery and whether the exchange can reopen normally without creating another security problem. For Bitget, containing the attack was step one. Getting customers their withdrawal access back is the next one, and the coming week will show whether the exchange’s assurances hold up under real withdrawal demand.
Comments are closed.