Bitget froze approximately $1.1 million linked to the nearly $388 million taken in its Sept. 24 cyberattack and rebuilt its Protection Fund above $300 million using its own capital. The exchange revised the loss estimate from $351.6 million after reconciling transactions across 12 hot and warm wallet addresses on 11 blockchains. Mandiant and SlowMist said attackers compromised two third-party security products, escalated to privileged access and circumvented withdrawal controls without extracting private keys. SlowMist traced the first hostile activity to Aug. 31 and a zero-day vulnerability in one affected product. Neither firm identified the products or attributed the attack. Bitget said cold wallets and customer balances were unaffected, while the Protection Fund remains separate from customer reserves. The exchange completed its phased restoration of cryptocurrency withdrawals, fiat services and C2C services, but Chen said recovery prospects remain limited. Bitget also reported a 131% reserve ratio across 19 covered assets as of Sept. 29, though proof-of-reserves disclosures are not audits.