Bitget Says It Has Pinpointed the Attack Path Behind $387.5M Exploit
TREE NEWS reports: Bitget’s Chinese-language lead, Xie Jiayin, said the exchange’s security team has precisely identified the attack path and methodology used in the September breach, and has obtained details on how the attacker bypassed its security defenses. The exchange says it is now very close to tracing the origin of the attack. Third-party security firms Mandiant and SlowMist remain engaged in the investigation and will publish a detailed report.
On-chain tracking confirms roughly $387.5 million in assets were moved to attacker addresses, revised upward from an earlier estimate of $351.6 million. The revision reflects newly counted ZEC and TRX holdings rather than any fresh theft, and no other unauthorized transfers have been detected.
Full Coverage From the User Protection Fund
Bitget stated that all funds stolen at the platform level will be fully covered by its user protection fund, leaving user assets unharmed. The exchange has also launched a recovery bounty program: anyone who voluntarily freezes attacker funds or actively helps recover assets can earn a 5% bounty, and assistance already provided qualifies retroactively. Bitget has published the attacker’s addresses, a real-time fund-tracking dashboard, and an information submission portal, and says it will announce withdrawal timing before 12:00 noon on September 26.
Why the Numbers Matter
The upward revision to $387.5 million places this among the larger exchange incidents of the year, even as the cause differs from the private-key and bridge exploits that dominated prior cycles. The key detail is the exchange’s claim that it has mapped the intrusion path and the bypass technique, which, if corroborated by Mandiant and SlowMist, would shift the narrative from an opaque breach to a contained, investigated incident.
The 5% bounty is a notable escalation in on-chain enforcement. At $387.5 million, a full 5% payout would exceed $19 million, a meaningful incentive for validators, market makers, and chain-analytics firms to cooperate. Similar programs have historically produced mixed results, but they increasingly function as a parallel to formal legal channels.
What to Watch Next
- The forensic report: Mandiant and SlowMist findings will determine whether the bypass was a novel technique or a known class of vulnerability.
- Fund recovery rate: How much of the $387.5 million is frozen or returned will test the bounty model’s effectiveness.
- Withdrawal resumption: The September 26 noon deadline is the immediate operational test of user confidence.
- Contagion risk: Whether the attacker’s addresses interact with mixers, bridges, or other exchanges will shape the next phase of tracing.
The incident also underscores a broader shift: exchanges are increasingly positioning protection funds and bounty programs as core infrastructure rather than marketing. If Bitget delivers full coverage and a credible post-mortem, the episode may reinforce that model. If recovery stalls, it will renew scrutiny of how exchange-level reserves are actually sized against tail risks.
