Bitget's hack bill rose to $387.5M; ETH withdrawals open September 29
The revised total adds Zcash and TRON rather than a second breach, and ETH still waits until September 29.
Bitget confirmed $387.5 million in assets moved to addresses the attacker controls, above an earlier count of $351.6 million.[1][2]
The gap is bookkeeping. The revision added Zcash and TRON assets the first count left out. Bitget said the higher total was not new theft.[3][4]
The funds it counted include XRP, ETH, USDT, ZEC, USDC, USDT0, XAUt, BNB, AVAX and TRX, on Ethereum and other EVM networks, the XRP Ledger, Zcash and TRON.[5][6]
Withdrawals return by asset. ETH on September 29 at 08:00 UTC, USDT on September 30, and other tokens, fiat and P2P on October 2.[7][8][9]
Balances held. The recount is filed on their page; the wait for the ETH is yours. Bitget said user balances were not touched, its Protection Fund covers the impact, and the flaw was found and fixed.[10][11]
Who gains, who loses
Receipts
Bitget confirmed that approximately $387.5 million in assets were transferred to attacker-controlled addresses.
“Based on the latest onchain tracing and transaction classification, Bitget has confirmed assets equivalent to approximately** $387.5 million were transferred to attacker-controlled addresses**.”
The revised loss figure exceeded Bitget’s initial estimate of $351.6 million.
“This exceeds the initial estimate of $351.6 million.”
Bitget said the revised figure resulted from a more complete accounting that added affected Zcash and TRON assets omitted from the initial estimate.
“The revised figure reflects a more complete accounting of transfers that occurred during the incident, adding affected assets on Zcash and TRON that were not included in the initial estimate.”
Bitget said the revised figure did not represent further unauthorized transfers.
“It does not reflect further unauthorized transfers.”
Bitget listed XRP, ETH, USDT, ZEC, USDC, USDT0, XAUt, BNB, AVAX and TRX among the confirmed affected assets.
“The confirmed affected assets include XRP, ETH, USDT, ZEC, USDC, USDT0, XAUt, BNB, AVAX and TRX.”
Bitget identified affected assets across Ethereum and other EVM networks, the XRP Ledger, Zcash and TRON.
“The incident involved assets across Ethereum and several EVM networks, XRP Ledger, Zcash and TRON.”
Bitget scheduled ETH withdrawals for September 29 at 08:00 UTC on Ethereum, BSC, Arbitrum, Base and Optimism.
“|29.09, 8:00|ETH|Ethereum BSC Arbitrum Base Optimism|”
Bitget scheduled USDT withdrawals for September 30 at 08:00 UTC on Ethereum, BSC, Solana and Tron.
“|30.09, 8:00|USDT|Ethereum BSC Solana Tron|”
Bitget scheduled withdrawals for other tokens, fiat and P2P services for October 2 at 08:00 UTC.
“|02.10, 8:00|Other Tokens / Fiat / P2P|-|”
Bitget said user account balances remained unaffected and that its Protection Fund covered the financial impact of the incident.
“User account balances remain unaffected, and Bitget's Protection Fund covers the financial impact of this platform-wide incident.”
Bitget said the vulnerability involved in the incident had been identified and remediated.
“The vulnerability involved in the incident has been identified and remediated.”
Cabal Desk is reporting, written with AI under human oversight. Every bracketed number opens its receipt: the source, the quoted span, the hash. Headlines and characterisations are commentary; the sourced facts are the receipts. Not investment advice. Corrections log. Editorial & legal.