Bitget said attackers stole about $387.5 million from hot and warm wallets across 12 blockchains beginning Sept. 24. The exchange initially estimated the loss at $351.6 million before adding Zcash and TRON transactions from the same period, and said its private keys were not stolen. Investigations by GoPlus Security, SlowMist and Mandiant found that attackers gained access through a third-party product and fed forged instructions into Bitget’s signing system, which approved the transfers. Blockchain tracking showed most pass-through volume moving through THORChain, with Chainflip used as a secondary route. AMLBot later identified two automated errors that left about $697,000, rounded to $700,000, inaccessible: roughly $267,000 in USDC was sent on Ethereum to a Chainflip deposit channel opened only on Arbitrum, while about 160 ETH, valued at approximately $430,000, was sent on Arbitrum to a channel existing only on Ethereum. Circle blacklisted the USDC receiving address, while the mismatched ETH remains stuck because no Arbitrum contract can sweep it. BlockSec previously estimated that about $342 million, including roughly 3,386 BTC, remained under attacker control nearly five days after the breach. Tether, Circle and cross-chain services including NEAR Intents have frozen or rejected only a small portion of the stolen funds. Bitget said its User Protection Fund covers the loss and launched a recovery bounty program offering 5% of funds frozen and 5% of funds recovered through eligible voluntary efforts.