Bitget's Chinese Region Head Xie Jiayin: Theft Revised to $387.5 Million with 5% Bounty
Bitget's Chinese region head Xie Jiayin stated that the security team has identified the attack path and methods, and is close to tracing the source. Mandiant and SlowMist are still investigating, with a complete report pending.
On-chain verification shows that assets transferred to the attacker's address amount to approximately $387.5 million, higher than the previous estimate of $351.6 million. The difference comes from the addition of ZEC and TRX, with officials stating no new unauthorized transfers have been found. Multiple attack addresses have been disclosed, covering EVM, XRP, ZEC, TRON, etc., with assets including XRP, ETH, USDT, ZEC, USDC, USDT0, XAUt, BNB, AVAX, and TRX, among which XRP accounts for about 103 million coins, valued at approximately $157 million.
The platform's gap is still fully covered by the user protection fund. Bitget has simultaneously launched a fund recovery bounty: those who voluntarily facilitate freezing or recovering funds will be rewarded 5% of the successful amount, and can use Bybit's LazarusBounty channel; court or law enforcement measures do not count towards the bounty. Withdrawals remain suspended, with a commitment to announce the recovery time before noon on September 26. The CEO previously indicated that the method was related to falsifying internal transfer data triggering withdrawals from hot and warm wallets, rather than private key theft, and stated that the network characteristics are similar to those of North Korean-related organizations.
The $387.5 million exceeds initial estimates from the beginning of the year, making it one of the largest publicly reported thefts from an exchange this year. The bounty turns white hats, exchange risk control, and on-chain detectives into a priced outsourcing recovery network, with 5% meaning that if fully recovered, the bounty budget would be approximately $19.38 million.
In market mechanisms, the seller is the attack address that splits multiple chains and mixes in privacy coins and TRON; the buyer is the over-the-counter and cross-chain liquidity that accepts exchanges. Funds are diverted after entering the marked address from the hot wallet, with the protection fund recording the gap in the platform reserves, while the bounty turns external freezes into liquid orders. Beneficiaries are users whose balances are guaranteed in writing and can still trade; the pressured parties are custodial chains of hard-to-freeze assets like ZEC and market makers that have not yet reopened withdrawals. The amount revision does not change the payment commitment, only alters the types of coins and the bounty base on the recovery map.
Source: Public Information
ABAB AI Insight
Xie has shifted the narrative from "the fund is sufficient for compensation" to "the path has been located, and the source is imminent." Mandiant is responsible for traditional forensics, while SlowMist is in charge of the on-chain mapping in the Chinese region. Before their reports are released, the official has disclosed the revised $387.5 million after adding ZEC and TRX, closing off speculation that "the digital amount is still increasing." The 5% bounty replicates the industry joint defense after the Bybit theft, giving freezing rights to the external nodes that act first, rather than waiting for judicial assistance.
The capital path involves reserve compensation plus market-based recovery. Bitcoin in the protection fund first fills user accounts, and the bounty pays 5% to the freezing executors from the recovered amount. The attacker splitting large amounts of XRP from ZEC and TRX is buying time: the freezing friction of alliance chains and privacy coins is higher than Ethereum tags. Falsifying internal transfer data instead of stealing keys indicates that the hot wallet strategy machine is still a single point in centralized exchanges; even with intact keys, erroneous commands can drain it.
Similar scripts are seen in Bybit's Lazarus tracking and the recovery market post-FTX bankruptcy. The current phase is turning suspected state-level attacks into priced bounty contracts. Those who can execute freezes on TRON and ZEC nodes become the new settlement layer; teams that can only tag on EVM cannot recover this incremental amount.
Structural judgment belongs to capital concentration. The nearly $400 million gap is no longer shared by users but absorbed by preset funds and the 5% outsourcing network. The mechanism is: the platform first internalizes the loss, then auctions the recovery rights to the fastest external executors. Pricing power shifts from the attacker's withdrawal robots to exchanges and nodes that can freeze addresses. The numerical revision is a completion of inventory, not a second theft.
ABAB News · Cognitive Law
The coins added after the initial estimate are the hard-to-freeze segment.
The 5% bounty turns recovery into an outsourcing order.
Keys are still intact, but erroneous commands can also drain the hot wallet.