Bitget's Chinese region head Xie Jiayin stated that the security team has identified the attack path and methods, and is close to tracing the source. Mandiant and SlowMist are still investigating, with a complete report pending.

On-chain verification shows that assets transferred to the attacker's address amount to approximately $387.5 million, higher than the previous estimate of $351.6 million. The difference comes from the addition of ZEC and TRX, with officials stating no new unauthorized transfers have been found. Multiple attack addresses have been disclosed, covering EVM, XRP, ZEC, TRON, etc., with assets including XRP, ETH, USDT, ZEC, USDC, USDT0, XAUt, BNB, AVAX, and TRX, among which XRP accounts for about 103 million coins, valued at approximately $157 million.

The platform's gap is still fully covered by the user protection fund. Bitget has simultaneously launched a fund recovery bounty: those who voluntarily facilitate freezing or recovering funds will be rewarded 5% of the successful amount, and can use Bybit's LazarusBounty channel; court or law enforcement measures do not count towards the bounty. Withdrawals remain suspended, with a commitment to announce the recovery time before noon on September 26. The CEO previously indicated that the method was related to falsifying internal transfer data triggering withdrawals from hot and warm wallets, rather than private key theft, and stated that the network characteristics are similar to those of North Korean-related organizations.

The $387.5 million exceeds initial estimates from the beginning of the year, making it one of the largest publicly reported thefts from an exchange this year. The bounty turns white hats, exchange risk control, and on-chain detectives into a priced outsourcing recovery network, with 5% meaning that if fully recovered, the bounty budget would be approximately $19.38 million.

In market mechanisms, the seller is the attack address that splits multiple chains and mixes in privacy coins and TRON; the buyer is the over-the-counter and cross-chain liquidity that accepts exchanges. Funds are diverted after entering the marked address from the hot wallet, with the protection fund recording the gap in the platform reserves, while the bounty turns external freezes into liquid orders. Beneficiaries are users whose balances are guaranteed in writing and can still trade; the pressured parties are custodial chains of hard-to-freeze assets like ZEC and market makers that have not yet reopened withdrawals. The amount revision does not change the payment commitment, only alters the types of coins and the bounty base on the recovery map.

Source: Public Information