The estimated assets affected by the Bitget security breach have risen to approximately $387.5 million after additional Zcash and Tron assets were included in the accounting. The exchange said the higher figure does not represent a second theft, but a more complete calculation of the September 24 incident. The Block
Bitget initially reported approximately $351.6 million in unauthorized transfers. CEO Gracy Chen said a critical backend system in the exchange’s wallet infrastructure was compromised, allowing the attacker to spoof transaction data and invoke the authorization process used to move assets. The Block
The company says private keys were not compromised. Bitget’s cold wallets and its separate self-custodial Bitget Wallet product were also described as unaffected. The Block
Stablecoin issuers Circle and Tether subsequently blacklisted a wallet containing roughly $318,000 in USDT and USDC connected to the incident. That represented only a small fraction of the stolen assets, with much of the value held in assets such as Ether that cannot be frozen by a centralized issuer. CoinDesk
Bitget has said its user protection fund exceeds the amount affected by the breach. Security firms including Mandiant and SlowMist were brought into the investigation, and law enforcement was notified. The Block
TOKEN RECON ASSESSMENT
The revised loss figure is less important than the reported attack path.
If Bitget’s account is correct, private-key protection worked while another critical layer failed. An attacker capable of manipulating backend transaction data and reaching the authorization process exposes a different class of exchange risk than straightforward key theft.
The investigation should therefore be judged on technical disclosure. Token Recon is looking for a precise explanation of the compromised component, how authorization controls were bypassed, what independent investigators confirm, and whether withdrawals resume without further anomalous activity.
Until those details are established, the chain proves that assets moved to attacker-controlled addresses. Bitget’s explanation of how the compromise occurred remains the company’s account of the incident.
Sources
The Block: Bitget confirms $387.5 million security breach
CoinDesk: Circle and Tether freeze assets connected to Bitget breach
