Key Takeaways
- • Bitget has increased its breach estimate to $387.5 million from an initial $351.6 million after tracing additional stolen assets across Zcash and TRON networks, representing a material upward revision of the attack's scope.
- • The exchange is offering dual 5% bounty rewards—one for freezing stolen funds and a separate 5% for recovering them—with eligibility determined by Bitget's internal assessment and excluding actions taken under court or law enforcement orders.
- • Circle and Tether have already frozen approximately $318,000 in USDC and USDT linked to the attack, demonstrating partial stablecoin issuer cooperation in asset recovery efforts.
- • Bitget CEO Gracy Chen has established a live tracing dashboard and submission portal for exchanges, security researchers, and on-chain investigators, with Bybit's LazarusBounty initiative serving as an additional reporting channel.
- • The exchange plans to restore withdrawals in phases beginning September 28, with the published list of primary receiving addresses spanning Ethereum, XRP Ledger, Zcash, and TRON networks.
Summary
Bitget has launched a two-tiered bounty program in response to a cryptocurrency theft that has ballooned to $387.5 million—significantly higher than the exchange's initial $351.6 million assessment. The revised figure reflects ongoing tracing efforts that identified additional stolen assets moved across multiple blockchain networks including Zcash and TRON. The bounty structure offers 5% of frozen funds and a separate 5% of recovered funds to eligible participants, though Bitget retains discretion over qualification determinations, contribution measurement, and payout amounts.
CEO Gracy Chen announced the recovery initiative via X (formerly Twitter), explicitly soliciting participation from exchanges, security researchers, and on-chain investigators. The program explicitly excludes rewards for actions undertaken pursuant to court orders, law enforcement requests, or other legal processes—a significant limitation that may reduce participation from institutional actors bound by regulatory channels. Importantly, the exchange has stated that voluntary freezing actions already completed prior to the bounty announcement may qualify for retroactive rewards alongside future recovery efforts.
Stablecoin issuers have begun cooperating on asset recovery. Circle and Tether have frozen approximately $318,000 in USDC and USDT associated with attacker addresses, providing an early demonstration of cross-protocol coordination. Bitget has published a live tracing dashboard and established a dedicated portal for information submissions, with the known receiving addresses distributed across Ethereum-compatible networks, XRP Ledger, Zcash, and TRON. The dashboard will be updated dynamically as investigators identify additional addresses and trace fund movements.
Service resumption is proceeding methodically. Bitget plans to restore withdrawals in phases beginning September 28, allowing the exchange to maintain operational control while recovery efforts continue. The breach was reportedly initiated through compromised wallet backend infrastructure and spoofed transaction data that circumvented the exchange's authorization mechanisms. Bybit's existing LazarusBounty initiative has been formally integrated as an additional reporting and tracking channel, broadening the ecosystem's coordinated response to the attack.
CEO Gracy Chen announced the recovery initiative via X (formerly Twitter), explicitly soliciting participation from exchanges, security researchers, and on-chain investigators. The program explicitly excludes rewards for actions undertaken pursuant to court orders, law enforcement requests, or other legal processes—a significant limitation that may reduce participation from institutional actors bound by regulatory channels. Importantly, the exchange has stated that voluntary freezing actions already completed prior to the bounty announcement may qualify for retroactive rewards alongside future recovery efforts.
Stablecoin issuers have begun cooperating on asset recovery. Circle and Tether have frozen approximately $318,000 in USDC and USDT associated with attacker addresses, providing an early demonstration of cross-protocol coordination. Bitget has published a live tracing dashboard and established a dedicated portal for information submissions, with the known receiving addresses distributed across Ethereum-compatible networks, XRP Ledger, Zcash, and TRON. The dashboard will be updated dynamically as investigators identify additional addresses and trace fund movements.
Service resumption is proceeding methodically. Bitget plans to restore withdrawals in phases beginning September 28, allowing the exchange to maintain operational control while recovery efforts continue. The breach was reportedly initiated through compromised wallet backend infrastructure and spoofed transaction data that circumvented the exchange's authorization mechanisms. Bybit's existing LazarusBounty initiative has been formally integrated as an additional reporting and tracking channel, broadening the ecosystem's coordinated response to the attack.
Go deeper than the headline
Research every firm in this story, track the ones that matter and get the daily briefing — free for 7 days.