How the Bitget hack figures moved: from $351.6 million to $387.5 million
Bitget raised its hack loss estimate from $351.6 million to $387.5 million after transfers on Zcash and Tron were counted, while laundering through THORChain, bridges and mixers keeps totals moving.
Bitget has raised the total stolen in its September 24 breach to $387.5 million, up from an initial estimate of $351.6 million, after accounting for additional transfers on Zcash and Tron. The revision landed alongside the exchange’s announcement that Bitcoin withdrawals resumed at 08:00 UTC on September 28.
“Bitget has begun the phased resumption of withdrawals following the security incident identified on September 24, with BTC withdrawals on the Bitcoin network started at 08:00 UTC on September 28 as scheduled,” the exchange said in a post on X, adding that the vulnerability has been remediated and no further unauthorized transfers were identified after containment.
Why the number moved
The $35.9 million gap between the two figures comes from transfers that early trackers did not see. The initial $351.6 million estimate, still cited in a September 28 post by on-chain tracker Lookonchain, was built from the visible movements out of Bitget’s hot and warm wallets on the chains analysts watch first. Bitget’s revision picked up transfers routed through Zcash and Tron, two networks that sit outside the main Ethereum and Bitcoin monitoring paths.
The gap matters beyond this incident. On the same day Bitget published its $387.5 million figure, Lookonchain was still describing the attacker as the one “who stole $351.6M” while reporting that the funds were being swapped from Ether to Bitcoin through THORChain, citing Arkham data showing attacker-linked ETH flowing into THORChain vaults.
Moving money makes moving targets
The revised total may not be the last word. Blockchain investigator ZachXBT said the funds are being chain-hopped via bridges and deposited into mixing services such as Wasabi, which obscures transaction origins. That laundering activity itself distorts the arithmetic: once value crosses a bridge or passes through a mixer, trackers see inflows and outflows on different chains at different prices, and totals computed at different moments disagree.
ZachXBT has also tied the laundering to a wider network. “Chinese illicit actors laundering funds from the $387M Bitget exploit on behalf of the alleged DPRK attackers are openly asking for support with orders in public Discord servers and Telegram channels of services they use,” he wrote on X, identifying five aliases with Discord and Telegram handles and transaction hashes. He said one of them had previously laundered funds from the $292 million KelpDAO exploit, and that he plans to publish more data on the groups in coming weeks. North Korea’s involvement remains suspected, not confirmed.
Bitget says its Protection Fund, previously reported above $464 million, will fully cover user losses, and it is offering a 5% bounty for freezing stolen funds plus another 5% for recovering them. Under the withdrawal schedule, Ether resumes Tuesday across Ethereum, BNB Smart Chain, Arbitrum, Base and Optimism, USDT on Wednesday, and other assets plus peer-to-peer services by Friday, October 2.
