Bitget Raises Estimated Losses From September Security Breach to $387.5 Million
Key Takeaways
- •Bitget increased its estimated losses from the September 24, 2026 breach from $351.6 million to approximately $387.5 million after tracing additional stolen assets.
- •The revised total reflects a fuller accounting of the original attack, including transfers on the Zcash and TRON networks, rather than a new wave of theft.
- •The stolen funds span ten different assets, including XRP, Ether, USDT, ZEC, USDC, XAUt, BNB, AVAX, and TRX.
- •The breach affected Bitget's internet-connected hot and warm wallets, while its offline cold wallets were not compromised.
- •Withdrawals remain suspended with no set resumption timeline as Mandiant and SlowMist assist the investigation, and some funds have been frozen under a recovery bounty program.
Crypto exchange Bitget has raised its estimate of the funds stolen in the September 24, 2026 security breach to approximately $387.5 million, after further tracing identified additional assets transferred to attacker-controlled wallets.
The revised figure is up from the exchange's initial estimate of $351.6 million. According to Bitget, the higher total does not represent a second wave of theft, but rather a more complete accounting of the transactions that took place during the original breach, including assets moved on the Zcash and TRON networks. Zcash is a privacy-focused blockchain, while TRON is a network widely used for USDT transfers, so the additional assets surfaced in two technically distinct environments.
The stolen funds include XRP, Ether, USDT, ZEC, USDC, USDT0, XAUt, BNB, AVAX, and TRX, according to Bitget.
Hot and Warm Wallet Infrastructure Affected
The transfers affected parts of the exchange's hot and warm wallet infrastructure — the internet-connected wallets exchanges rely on to process deposits and withdrawals. Bitget said its cold wallets, which are kept offline, were not compromised.
The exchange said the attack has been contained and that no further unauthorized transfers were possible. Withdrawals have been suspended while security checks continue, with cybersecurity firm Mandiant and blockchain security company SlowMist assisting the investigation. No timeline for resuming withdrawals has been given.
In parallel, Bitget has launched a recovery bounty program aimed at supporting efforts to recover the stolen assets, and said that some of the funds have already been frozen through cooperation with industry participants.
One of 2026's Largest Crypto Thefts
The updated total places the incident among the largest cryptocurrency thefts reported in 2026 and illustrates how initial loss estimates can rise as investigators trace assets across multiple blockchains — a process that becomes more involved when stolen funds span ten different assets and include transfers on a privacy-focused chain. The immediate developments to watch are the findings of the Mandiant and SlowMist review, progress under the recovery bounty program, and any announcement on when withdrawals will resume.
Source: BitcoinKE
