Bitget Security Latest Incident Update: Fund Tracing and Recovery Bounty Program

Bitget's security team has identified the attack path and methods used in the incident, including details of how the attacker bypassed existing security controls. The investigation has also made significant progress in tracing the source of the attack.

The underlying vulnerability has been identified and remediated. Technical teams are now focusing on the security validation and preparations required to safely restore withdrawals.

The incident remains contained and no further unauthorized transfers are possible. Further updates, will be shared through Bitget's official channels as soon as they are confirmed. The withdrawal status/timing will be announced by September 26th, 4:00AM UTC.

Bitget is continuing its investigation and recovery efforts following the security incident identified on September 24. Independent cybersecurity experts Mandiant and SlowMist are working with Bitget on the investigation, while our security and technical teams continue remediation and additional security checks.

Based on the latest onchain tracing and transaction classification, Bitget has confirmed assets equivalent to approximately $387.5 million were transferred to attacker-controlled addresses . This exceeds the initial estimate of $351.6 million . The revised figure reflects a more complete accounting of transfers that occurred during the incident, adding affected assets on Zcash and TRON that were not included in the initial estimate. It does not reflect further unauthorized transfers. The incident remains contained and no further unauthorized transfers are possible.

The incident involved assets across Ethereum and several EVM networks, XRP Ledger, Zcash and TRON. The primary attacker-controlled receiving addresses identified to date are:

EVM: 0x770b10b273fc44fe9197d6bf20f145c2e98463ee

XRP: rwNhefsz1UQEusxhCvHip3RANinWi4CTck

ZEC: t1WgMdtND8NF7NDUuYmq8MpMj1NTCXkMDVG

TRON: TBWNguTTgezw9dVorX441C6nDrZpRxYwKD

The confirmed affected assets include XRP, ETH, USDT, ZEC, USDC, USDT0, XAUt, BNB, AVAX and TRX.

Our investigation and tracing efforts remain ongoing. The figures above reflect information confirmed at the time of publication and may be updated as additional transactions are classified and traced.

The Bitget Recovery Bounty Program

Recovery efforts are already underway, with some of the affected assets successfully frozen through coordination with industry partners. Bitget appreciates the swift response from exchanges, blockchain projects, security firms and members of the wider onchain community whose actions have helped identify, trace and freeze affected funds.

To support and expand these efforts, Bitget has launched a Recovery Bounty Program covering eligible voluntary actions that have already resulted in affected funds being frozen, as well as future actions that directly contribute to the freezing or recovery of funds.

Bounties will be calculated in proportion to the amount of affected funds successfully frozen or recovered:

5% of successfully frozen funds will be available as a bounty to the eligible person or entity whose voluntary efforts directly resulted in the funds being frozen.

5% of successfully recovered funds will be available as a bounty to the eligible person or entity whose voluntary efforts directly resulted in the funds being recovered.

Bitget will also use Bybit's LazarusBounty initiative as a core channel supporting the bounty and recovery effort.

Actions taken pursuant to court orders, law-enforcement requests or other legal processes are excluded from bounty eligibility.

Final determination of eligibility, contribution, calculation methodology and bounty amounts will be made by Bitget. Participation does not guarantee payment of a bounty. Participants must comply with all applicable laws, and false or misleading submissions will be disqualified. Bitget reserves the right to amend or terminate the program.

To support the recovery, Bitget has made live tracing information available to blockchain projects, security teams and other participants.

Real-time fund tracing dashboard:

Submit recovery or freezing information:

Attacker address API — advanced tracker updated in real time:

The dashboard and API will continue to be updated as affected funds move and additional addresses are identified. Exchanges, stablecoin issuers, bridges, blockchain projects, custodians and other infrastructure providers are encouraged to monitor these addresses and report relevant information through the recovery portal.

For informational purposes only.

Join Bitget, the world's largest Universal Exchange (UEX)

Join our Community >>>