Bitget Updates Hot Wallet Incident: Affected Funds Estimated at 387.5 Million Dollars

Bitget published an update on the hot wallet security incident on September 25, 2026 at 22:05 Hong Kong time. The page displays the original timestamp as 14:05 UTC.

Bitget said its security team identified the attack path and the methods used to bypass existing controls. The exchange also said it had fixed the underlying vulnerability and was completing security validation before restoring withdrawals. The incident was described as contained, with no further unauthorized transfers possible according to Bitget's notice.

Revised amount and affected assets

Bitget revised its estimate of transferred funds from about 351.6 million US dollars to about 387.5 million US dollars. The exchange said the revision included assets on Zcash and TRON that were not included in the first estimate, and did not represent additional unauthorized transfers.

The notice identifies affected assets including XRP, ETH, USDT, ZEC, USDC, USDT0, XAUT, BNB, AVAX, and TRX. Bitget said Mandiant and SlowMist were working with its teams on the investigation and fund tracing.

Recovery bounty program

Bitget said it would offer a bounty equal to 5% of affected funds successfully frozen and another 5% of affected funds successfully recovered. The reward is for a person or organization whose voluntary action directly contributes to freezing or recovering the funds.

Actions taken under court orders, law-enforcement requests, or other legal processes are excluded. Bitget will make the final decision on eligibility and reward amounts, and participation does not guarantee payment.

Withdrawal status

At the time of the update, Bitget was still preparing to restore withdrawals. The exchange said it would announce the withdrawal status and timing by September 26 at 12:00 Hong Kong time. Users should rely on Bitget's official updates for the current service status and should not infer a recovery schedule before that announcement.