Bitget Raises Hack Estimate to $387.5M, Plans Withdrawal Restart

Bitget has raised the value of assets moved into attacker-controlled wallets to roughly $387.5 million, up from the $351.6 million it first disclosed. The exchange says the vulnerability behind the breach has been identified and remediated, and it has set a timetable for restoring withdrawals, with bitcoin first on September 28.

What Bitget has confirmed so far

In an update published this week, Bitget said the higher figure reflects additional assets uncovered while tracing the flow of funds, not a fresh round of unauthorized transfers. That distinction matters for anyone sizing the incident. The exchange is describing one breach whose recorded scope has grown as analysts follow the money, rather than an attacker who struck twice.

No second wave of transfers took place, according to Bitget.

Bitget is a centralized exchange built in part around copy trading, which lets smaller users mirror the positions of experienced traders. Products like that lean on the custody and margin layer sitting behind the platform, so a pause in withdrawals touches more than spot holders. The exchange has made its security finding the gate on restoring full service.

Bitget says the flaw that allowed the transfers has been patched. Restarts after a breach usually follow the same order: stop the outflow, trace the funds across addresses and bridges, fix the entry point, then reopen access in controlled batches so that a run on the platform does not compound the damage. The calendar Bitget published matches that pattern, with the vulnerability fix announced ahead of the restart.

Why the loss estimate keeps moving

First-pass loss numbers after an exchange breach are estimates built from the wallet addresses known at disclosure. As tracing teams tag more addresses and follow swaps and bridge activity, the tally moves. Bitget's shift from $351.6 million to $387.5 million adds about $35.9 million, close to 10% of the original figure.

Bitget attributes the change to tracing, not to new theft.

For traders, a rising estimate signals the quality of the initial accounting rather than proof of ongoing risk. If the increase comes from retroactive tracing, that exposure was already inside the original event. If a figure jumps with no explanation attached, the likelier reading is that unauthorized transfers kept flowing while the exchange was still measuring. Bitget has placed its revision firmly in the first camp.

Tracing runs across chains and often through bridges, which is why totals settle slowly.

When will withdrawals reopen?

Bitget says withdrawals return in stages, with bitcoin opening first on September 28 and the rollout continuing through October 2. The exchange framed the sequence as a controlled restart rather than a blanket reopening, which means access is restored asset by asset as the week runs on. The plan follows the patch already announced by the exchange.

Only bitcoin has been named for the September 28 opening.

Staged restarts are a risk control. A single simultaneous reopening would invite a surge of exit demand from users who want funds off a venue that has just absorbed a nine-figure loss. By spreading access across assets, the exchange can watch outflows, keep custody systems under load, and pause the process if conditions change. A slip in the published dates would be the clearest sign that remediation is not as settled as the statement suggests.

The full window runs from September 28 to October 2.

How does this compare with other exchange thefts?

At $387.5 million, the Bitget incident ranks among the larger single-venue thefts of recent years, though it sits below the biggest on record. The largest centralized exchange failure remains Mt. Gox, which collapsed in 2014 after losing about 850,000 bitcoin. Bridge exploits have produced bigger headline sums as well, including the Ronin attack in 2022, valued at roughly $620 million at the time, though that hit cross-chain infrastructure rather than an exchange's own custodied balances.

Centralized exchanges have absorbed comparable thefts and kept operating.

What happens after the number is settled matters more for users than the number itself. Venues that have taken comparable losses have typically frozen deposits, published holdings, and drawn on company reserves or insurance while investigators pursue the funds. Bitget's published path is different: patch, trace, then restore withdrawals on a schedule. Whether a reimbursement commitment follows would be the next material disclosure.

Recovery of stolen crypto is slow and usually partial.

What does this mean for Bitget traders?

Traders on Bitget face a defined wait, since balances stay on the platform until the asset they hold clears in the staged reopening. The timetable covers withdrawals, and the status of deposits and of assets outside the first tranche will come in the exchange's subsequent notices. Anyone positioned on the venue needs to plan around a sequence of dates rather than a single reopening.

Bitcoin holders regain access before traders in other markets.

A nine-figure outflow from any venue shows up in order books and in the plumbing beneath them. Bitcoin is the deepest market on every major exchange, so coins moving off Bitget in late September are absorbable, but they still travel to other wallets or other venues where they may be held or sold. Derivatives positions, copy-trading strategies and staked products on the platform all depend on the same custody layer, which is why the pace of the restart matters as much as the headline total.

Restoration plans also test credibility. Users who see bitcoin withdrawals complete on schedule on September 28 will treat the rest of the calendar with more confidence than users who see delays. The same test applies to counterparties watching from outside, because the dates are a public commitment and follow-through is measurable within days.

What to watch next

The first checkpoint is September 28, when bitcoin withdrawals are scheduled to open, and the pace of outflows in the first hours will show how much demand for exit built up during the closure. The window then runs to October 2, when the remaining stages are due to complete. Any change to either date, or any further revision to the $387.5 million figure, would be a material update for anyone holding funds on the venue.

Tracing could still move the total in either direction.

Two risks sit above the calendar. The first is that tracing continues to push the total higher, which would suggest the map of attacker addresses was incomplete. The second is that the patched weakness reappears or that a related flaw surfaces elsewhere in the platform. Bitget says the vulnerability has been remediated, and the withdrawal schedule is the first public test of that claim.

Exchange incidents rarely move the wider market on their own unless they threaten contagion. A theft confined to one venue's custodied balances does not carry the systemic weight of a lending collapse that spreads across lenders. The likelier effects are local, confidence among the exchange's own users, and a fresh round of proof-of-reserves demands across centralized venues.