⏱ 2 min read
The higher total reflects newly tallied Zcash and TRON transfers; recovery now hinges on the asset mix and whether issuers freeze stablecoins.
Bitget increased its estimate of assets impacted by Thursday’s security breach to $387.5 million and kept customer withdrawals paused, while launching a bounty program to encourage freezing or recovering funds.
According to the exchange’s Friday update, onchain tracing shows $387.5 million moved to attacker-controlled addresses—about $35 million more than it reported a day earlier. Calculation: $387.5m minus the prior $352m figure implies a $35.5m upward revision. Bitget said the change reflects a more complete accounting that adds affected assets on Zcash and TRON, not new unauthorized transfers. The company said the incident is contained and no further unauthorized transfers are possible.
The exchange listed affected addresses on EVM networks, the XRP Ledger, Zcash and TRON. Reported assets include XRP, ETH, USDT, ZEC, USDC, USDT0, XAUt, BNB, AVAX and TRX. The follow-up did not address earlier comments from CEO Gracy Chen speculating about a North Korean group, leaving attribution unconfirmed.
The mechanism that matters
Cross-chain breaches complicate forensics. Adding Zcash and TRON after the initial estimate suggests the first pass may have been EVM-centric, with subsequent tracing extending to non-EVM and privacy-oriented networks. That sequence is consistent with incident responses where coverage beyond the primary stack lags, raising the headline number as additional chains are reconciled.
Recovery prospects hinge on what the attacker holds. Some assets—like certain stablecoins and XAUt—can sometimes be frozen by their issuers, which can limit the attacker’s spendability if issuers act. Native assets such as ETH, XRP, BNB, AVAX and TRX generally cannot be reversed at the protocol level, which typically reduces recovery odds absent negotiated returns or seizures.
▲ 0.27%
▲ 2.28%
Limitations
The update does not provide an asset-by-asset or chain-by-chain breakdown, confirmation of any issuer freezes, a timeline to resume withdrawals, or law-enforcement detail. Without those, the recovery rate and user impact remain uncertain. The supplied material characterizes this as among the industry’s larger breaches and cites a $1.5 billion Bybit theft in February 2025, but we have only the provided assertion for that context.
What to watch next
- Issuer actions on freezeable tokens (USDT/USDC/XAUt) and any onchain freeze transactions.
- An asset-level and chain-level breakdown of the stolen funds.
- Updates on recovery and the timeline to resume withdrawals.
- Any formal attribution and law-enforcement involvement.
HafidWatch Take: The revised $387.5m figure is less about drift than scope: once Zcash and TRON were folded in, the incident’s true cross-chain footprint became clearer. Absent a breakdown, the asset mix—not the headline number—will decide recoveries. The first hard signal of resilience will be how quickly Bitget reopens withdrawals, which will say more about liquidity and operations than any assurance that the incident is “contained.”
This content is for informational purposes only and does not constitute financial advice.
🧠 HafidWatch Take
The revised $387.5 million figure highlights the operational risks in cross-chain custody, with the inclusion of Zcash and TRON revealing initial blind spots beyond EVM-compatible assets. The asset mix matters more than the total amount since some tokens like stablecoins and XAUt may be frozen, while others like ETH, XRP, BNB, AVAX, and TRX generally cannot. Without an asset-level breakdown or issuer freeze confirmations, recovery prospects remain unclear. The quickest resumption of withdrawals will provide the clearest indication of Bitget’s liquidity and operational resilience, rather than claims that the incident is “contained.”
🔗 Tools mentioned in this article
Affiliate disclosure: Links above may earn HafidWatch a commission at no cost to you.
Daily crypto intelligence. Before the market opens.
Including the Divergence Index — the sentiment gap no other newsletter tracks. Free, every morning at 7:30am ET.
✓ Free forever · ✓ No spam · ✓ 50+ sources monitored
