Bitget Exchange has updated the total loss from its recent security breach to $387.5 million, an increase from the initial estimate of $351.6 million. The revision follows forensic investigations by Mandiant and SlowMist that identified additional stolen assets on the Zcash and TRON networks. CEO Gracy Chen confirmed that the attacker exploited a vulnerability in a third-party security product to obtain high-level internal credentials, allowing them to forge withdrawal commands without compromising private keys or cold wallets.
Bitcoin withdrawals resumed on September 28 at 08:00 UTC, with Ethereum, USDT, and other tokens scheduled for phased restoration through October 2. Approximately $343 million remains dormant across 13 attacker wallets, including significant holdings in ETH, XRP, and ZEC. A public dispute emerged between Bitget and THORChain after the decentralized protocol declined Bitget’s request to block attacker addresses, citing its permissionless design architecture.
The incident highlights a critical shift in attack vectors toward operational infrastructure rather than cryptographic vulnerabilities. By exploiting a third-party security tool to bypass risk controls, the attackers demonstrated how supply chain weaknesses can compromise exchange security even when private keys remain intact. This method aligns with broader industry trends where operational failures account for a majority of crypto losses, emphasizing the need for rigorous vetting of internal software integrations.
The refusal by THORChain to block specific addresses underscores the persistent tension between centralized compliance demands and decentralized protocol principles. While stablecoin issuers like Circle and Tether froze approximately $318,000, the vast majority of stolen funds in non-stablecoin assets remain beyond the reach of centralized intervention. This limitation suggests that future recovery efforts will rely heavily on law enforcement and bounty programs rather than technical censorship mechanisms within decentralized liquidity protocols.
