Bitget raised its estimate of affected assets to $387.5 million and set a phased withdrawal schedule. The balance may be protected. Access still has a calendar.
A crypto balance can look intact while access to it still runs on somebody else’s clock.
Bitget has raised its estimate of assets transferred to attacker-controlled addresses from approximately $351.6 million to $387.5 million. The exchange says the higher figure reflects a fuller accounting that now includes affected assets on Zcash and TRON — not a second wave of unauthorized transfers.
The company also published a phased timetable for restoring withdrawals. Bitcoin withdrawals are scheduled to restart on September 28 at 08:00 UTC. Ethereum, BSC, Arbitrum, Base and Optimism follow on September 29. Major USDT networks are scheduled for September 30. Other tokens, fiat and P2P withdrawals are expected on October 2.
IN 30 SECONDS
- Bitget says about $387.5 million reached attacker-controlled addresses.
- The previous estimate was $351.6 million.
- The exchange says the vulnerability was identified and remediated.
- Trading and deposits remain operational.
- Withdrawals are scheduled to return in phases from September 28 through October 2.
- Mandiant and SlowMist are supporting the investigation, according to Bitget.
THE NUMBER THAT MATTERS
$387.5 million
That is Bitget’s latest estimate of assets transferred to attacker-controlled addresses. The investigation is continuing, and the company says the figure could change as more transactions are classified.
The balance was visible. The exit was not.
Bitget says user account balances remain accurate and that its Protection Fund will cover the financial impact. It also says cold wallets were not affected and that the incident was confined to parts of its hot- and warm-wallet infrastructure.
Those claims matter. But they answer only one question: whether the platform says customers will be made whole.
They do not erase the second question: when can customers move their own assets?
That distinction is the financial core of the story. Solvency is about whether the money exists. Liquidity is about whether the money is available when you need it. For a user, a protected balance with temporarily disabled withdrawals is safer than a missing balance — but it is not the same thing as cash under your control.
Why the revised number matters
The jump from $351.6 million to $387.5 million is roughly $35.9 million. Bitget says this came from identifying additional affected assets, including transfers involving Zcash and TRON, rather than new unauthorized activity.
The company says the attack path has been identified, the underlying vulnerability has been fixed and no further unauthorized transfers are possible. Those are company statements, not an independent final report. The investigation remains open.
Bitget has launched a recovery bounty program offering 5% of funds successfully frozen or recovered to eligible parties whose voluntary work directly produced that result. It also says some affected assets have already been frozen, without publishing a final recovered amount.
MNS LENS
Crypto often sells ownership as a binary idea: either the coins are yours or they are not. Real life is messier.
When assets sit on a centralized exchange, the user owns a claim inside a platform. The exchange controls the operational layer: wallets, security checks, withdrawal rails and emergency pauses. That convenience is useful — until the exit button becomes part of the incident.
The lesson is not that every investor should move every coin immediately. Self-custody creates its own risks, including lost keys, scams and irreversible mistakes. The better lesson is concentration: money needed for bills, emergencies or near-term decisions should not depend on a single exchange’s ability to process withdrawals.
WHAT DOES THIS CHANGE?
If you use a crypto exchange, check three things that are easy to ignore during calm markets:
- How much of your portfolio is concentrated on one platform?
- Which assets would you need to access quickly?
- Do you understand the trade-off between exchange custody and self-custody?
The answer will be different for a trader, a long-term holder and someone who simply bought crypto once. The risk is not only price. It is also access.
WHAT TO WATCH NEXT
- Whether Bitget restores each withdrawal channel on the published schedule.
- Any independent findings from Mandiant, SlowMist or authorities.
- The amount of assets frozen or recovered.
- Whether the $387.5 million estimate changes again.
- Any evidence contradicting the company’s statement that user balances and cold wallets remain unaffected.
ASK NOVA
What should I check before keeping money on a crypto exchange — and how much liquidity should I keep somewhere else?
SOURCES
Facts and timelines in this article come from Bitget’s official security notices dated September 24–26, 2026. The company says the investigation remains ongoing.
The headline is only the start.
Ask Nova what this story could change in your budget, savings, debt, investments or next purchase.
