Bitget puts the theft estimate at $387.5 million and keeps withdrawals paused

Bitget's Friday update raised the theft estimate and did not say again that its protection fund covers the new total. The promise on record is still the one Chen made Thursday night, against about $351.6 million, before assets on Zcash and TRON were added to the count.

Bitget's systems flagged the outflows at 2:31 p.m. New York time on Thursday. Chen said the attacker got into a core system behind the wallets, faked the transaction records, and triggered Bitget's own approval step to move the funds out. She ruled out a compromise of the private keys, the codes that approve a transfer.

Chen said the breach reached parts of the hot wallets, kept online so the exchange can send assets quickly, and the warm wallets between those and the cold wallets. She said the cold wallets, which stay offline, were secure, and that no further unauthorized transfers were possible. How the attacker first got in was still under investigation, she said, and work with the security firms Mandiant and SlowMist would take more than 24 hours. Withdrawals stayed paused while deposits and trading remained open, Bitget said.

Friday's figure is larger than the roughly $319 million in bitcoin taken from the Liquid Network on Sunday, September 6. On Tuesday, September 8, TRM Labs, a blockchain research firm, called that the biggest crypto theft of 2026 to that point. Most of that bitcoin was later returned. Bitget's figure is still much smaller than the roughly $1.5 billion taken from the exchange Bybit in February 2025.

Chen said Friday that the attack method was highly consistent with known patterns of North Korean hacker groups. She did not name who carried it out. Scorechain, a blockchain-analysis firm, attributed the attacker wallets it mapped to North Korea's Lazarus Group, and said the indications are early. As of 7 a.m. in New York, it said, almost all of the stolen value it had mapped was still in those wallets, and that exchanges could block a deposit of it. Chen has said, separately, that some blockchain foundations froze addresses linked to the attacker.

On Thursday night she said user funds were safe, and that the loss fell within a protection fund of more than $464 million, a reserve Bitget says it keeps for customer losses. Bitget says the fund is 5,500 bitcoin, valued at $464 million using bitcoin's price at midnight UTC. It also said, before the estimate rose, that the fund would cover the hot-wallet losses after an assessment. Early Friday afternoon in New York, bitcoin was at $83,851. At that price the 5,500 bitcoin were worth about $461 million, still above the revised estimate of about $387.5 million. That is the afternoon price of the coins, not a promise repeated against the new total. Bitget has described coverage. It has not reported a payment.