Regarding the large-scale unauthorized outflow incident that occurred at the cryptocurrency exchange Bitget, the company announced the latest update on the damage situation on September 25, 2025.
In addition to the upward revision of the estimated damage from initial figures, we will clearly organize key points such as collaboration with external specialized agencies and suspicions of involvement by North Korean hacker groups.
1. Revision of damage amount and current situation
-
Upward revision of damage amount: The figure has been revised upward from the initial estimate (approximately 550-560 million yen, approximately 350 million dollars) to approximately 387.5 million dollars (approximately 61 billion yen in Japanese yen).
-
Reason for upward revision: This is because outflows of assets on Zcash (ZEC) and TRON that were not included in the initial tally were added during the investigation process. The company also stated that “no additional unauthorized transfers or new thefts have occurred.”
-
Outflow route and security measures: Investigations are being conducted in collaboration with external security firms such as Mandiant and SlowMist, and the fundamental vulnerabilities used for the unauthorized access are said to have already been patched.
2. “Bounty Program” for fund recovery and tracking system
To recover the leaked funds and identify the perpetrators, the following strong measures are being taken.
-
Recovery Bounty: A program has been launched to pay a bounty of 5% of the frozen/recovered amount to individuals or organizations that directly contribute to the freezing or recovery of the leaked funds.
-
Publication of real-time monitoring system: A dedicated system that can track the hacker’s fund movements has been made public, and information sharing is being widely requested from relevant institutions such as exchanges and infrastructure companies.
-
Suspicions of involvement by North Korean hacker groups: According to broadcasts by CEO Gracy Chen and others, suspicions of involvement by North Korean hacker groups have emerged based on characteristics such as the VPN IP addresses used in past attacks.
-
Industry-wide support: A cross-industry support system has also been built, such as utilizing the system of the “Lazarus Bounty” site launched by Bybit, which was also a victim in the past.
3. Points to note for Japanese users and future schedule
-
Withdrawal suspension and resumption plan: Since the incident was discovered, withdrawals have remained suspended, but the company plans to announce a concrete plan and timing for the resumption of withdrawals by 13:00 on the 26th (Japan time).
-
Impact on the termination of services for Japanese residents: Amidst the movements of reorganization and withdrawal by bitbank and other companies, this trouble occurred while Bitget itself was already in the process of terminating services for Japanese residents (scheduled to transition to settlement-only mode on November 1st and forcibly settle remaining positions on December 31st). Please pay close attention to future announcements and the handling of assets.
Thank you for reading to the end! If you found this article helpful, please give it a “Like (heart mark)” or follow us!
