Bitget is offering a 5% bounty for freezing stolen funds and a separate 5% for recovering them, after raising its estimate of the assets an attacker moved out of its wallets to $387.5 million. Circle and Tether have already frozen roughly $318,000 tied to the incident, and the exchange plans to resume withdrawals in phases starting Sep. 28.
Bitget CEO Gracy Chen announced the bounty program on X, asking exchanges, security researchers and on-chain investigators to help trace the stolen funds. She also thanked Circle and Tether for freezing assets connected to the attack.
Bounty splits freezing and recovery into separate rewards
Under Bitget's program, a participant can earn 5% of the funds they directly help freeze and another 5% of what they directly help recover. The exchange said voluntary actions that already led to a freeze can qualify alongside future efforts, though it alone decides who qualifies and how much to pay. Actions taken under court orders or law enforcement requests are excluded.
Bitget has opened a live tracing dashboard and a submission portal for information about affected funds, listing primary receiving addresses across Ethereum and other compatible networks, XRP Ledger, Zcash and TRON. Circle and Tether have frozen 99,990 USDC and 218,023 USDT tied to the attack, together worth roughly $318,000, and Bitget said other assets have been frozen through work with industry partners without giving a combined total.
Transferred-assets estimate rises to $387.5 million
Bitget's latest tracing puts the value moved to attacker-controlled addresses at approximately $387.5 million, up from its initial $351.6 million estimate. The company attributed the increase to a fuller accounting of the original incident, including assets on Zcash and TRON, rather than further unauthorized transfers.
Investigators believe an attacker compromised a backend wallet service, fed false transfer information into Bitget's systems and triggered its authorization process; Chen said the preliminary probe had ruled out a private-key leak. Bitget said its team has since identified the attack path and fixed the underlying vulnerability, with Mandiant and SlowMist assisting the investigation.
Withdrawals return in phases starting Sep. 28
Bitget published a withdrawal schedule on Sep. 26 after further system checks. Bitcoin withdrawals resume at 08:00 UTC on Sep. 28, followed by Ethereum withdrawals on Sep. 29, USDT on Sep. 30, and other tokens, fiat and peer-to-peer services on Oct. 2.
The exchange said customer account balances remain unaffected and its Protection Fund, valued at more than $464 million in its first notice, covers the incident's financial impact. Bitget has not published an updated fund valuation alongside the $387.5 million figure. Chen is scheduled to host a live question-and-answer session at 07:30 UTC on Sep. 28 to discuss the incident and Bitget's next steps.
Source: crypto.news
Trading involves risk.
Risk Disclaimer
