Bitget now puts its loss from last week’s attack at about $388 million, up from the $351.6 million it first confirmed, which The Block says makes it the largest reported crypto theft of 2026 so far. The exchange began restoring withdrawals on Monday in stages: bitcoin first, ether on Tuesday, USDT on Wednesday, and all remaining assets, fiat and peer-to-peer transfers on 2 October.
Bitget’s account of the breach has also changed. Chief executive Gracy Chen initially described a compromised backend system feeding spoofed data into the wallet approval process. The latest version says attackers exploited a vulnerability in a third-party security product to obtain high-level internal credentials, then used them to send fraudulent withdrawal commands that bypassed risk controls. The company still says no private keys were taken, still suspects a state-backed attacker, and says its User Protection Fund, which holds 5,500 bitcoin, will cover every loss.
Getting the money back is proving harder. Chen publicly asked THORChain, the cross-chain swap protocol, to refuse transactions from the attacker’s addresses, arguing that decentralisation is a design principle rather than a shield for known stolen funds. THORChain declined, saying it can halt the whole network in an emergency but cannot selectively freeze particular addresses or swaps without disrupting legitimate users. CoinDesk counted 27 swaps on Monday converting about 2,390 ether, worth roughly $6.3 million, into 75.2 bitcoin.
Bitget says some assets have already been frozen with the help of industry partners and is offering a 5 percent bounty on anything recovered, but it has not said how much is frozen. That figure, set against $388 million, will show whether the industry’s informal cooperation on stolen funds holds up once a major protocol declines to take part.
