BlockSec: $387.5M Stolen From Bitget, Under $1M Frozen

According to BlockSec’s fund-flow analysis , the reported loss was revised upward from an initial estimate of roughly $351. 6 million to approximately $387.

Blockchain security firm BlockSec says approximately $387.5 million was stolen from Bitget in a hot wallet breach detected on September 24, 2026, and that publicly visible freezes amount to less than $1 million, leaving a substantial reported recovery gap that highlights the limits of on-chain asset freezing after a major exchange hack.

BlockSec Reports $387.5M Stolen From Bitget

According to BlockSec’s fund-flow analysis, the reported loss was revised upward from an initial estimate of roughly $351.6 million to approximately $387.5 million after Zcash and TRON wallet transfers were factored in. Arkham Intelligence reported that Bitget confirmed those two additional compromised wallets, bringing the total to the revised figure.

Revised affected-assets total

$387.5M

Bitget said its latest on-chain tracing put affected assets at approximately $387.5 million.

TRM Labs independently observed an estimated $351.6 million moved from Bitget hot and warm wallets on September 24, spanning Ethereum, XRP Ledger, Arbitrum, Avalanche, Optimism, BNB Chain, and Base. Elliptic placed the initial detection at approximately 18:31 UTC on September 24, 2026, after which Bitget suspended withdrawals.

BlockSec’s analysis notes that $183 million in stablecoins were swapped into ETH within hours of the breach, a move consistent with laundering strategies that BlockSec has previously tracked in other DeFi-adjacent security incidents. Ethereum was trading at $2,414.71 at the time of this report, making the ETH conversion a substantial on-chain position.

Less Than $1M Frozen Highlights the Recovery Gap

BlockSec’s public-freeze tally stands at roughly $840,000, split between approximately $340,000 frozen by stablecoin issuers Tether and Circle, and approximately $503,000 attributed to NEAR Intents. That total represents around 0.2% of the $387.5 million BlockSec attributes to the breach. For related coverage, see The TempleDAO protocol was "stolen" $ two.three million.

Publicly visible freezes

~$840K · 0.2%

BlockSec reports roughly $840,000 frozen publicly—about 0.2% of the revised reported loss.

NEAR Intents reportedly blocked around $50 million in attempted cross-chain swap transactions but only succeeded in catching $503,000 of that volume. The distinction matters: blocked attempts are not frozen funds, and funds that route successfully through cross-chain infrastructure remain outside issuer reach. For related coverage, see Compound Launches on Unichain With New Collateral.

Bitget: $387.5M stolen. Less than $1M frozen.

Full fund flow analysis: https://t.co/LaCx8NBEpW

$183M swapped into ETH within hours. Issuers froze $339K. NEAR Intents blocked $50M in attempts but caught $503K. THORChain let it all through.

Tracing worked. Freezing did not,… For related coverage, see Bitcoin, Ether and AI Stock Perpetuals Fall on Black Monday Fears.

— BlockSec (@BlockSecTeam) September 30, 2026

BlockSec characterized the broader pattern bluntly: tracing worked, but freezing did not. That gap is notable given the scale of the incident, which Elliptic said pushed suspected North Korea-linked crypto thefts past $1 billion in 2026. The DPRK attribution remains a qualified assessment from industry investigators, not an official law-enforcement finding.

The Crypto Fear & Greed Index sits at 53 (Neutral) as of this report. The hack and its limited freeze outcome echo prior incidents where on-chain forensics moved faster than the legal and technical mechanisms needed to act on them, a dynamic the broader industry has yet to resolve. The XRP Ledger was among the chains affected in the initial outflows TRM Labs traced, alongside Ethereum and several other networks.

Watch for further freeze announcements from Tether, Circle, or law-enforcement partners in the coming 24 to 72 hours, as well as any updated on-chain tracing from BlockSec or Arkham that narrows down the current location of the converted ETH holdings. Any issuer action on the roughly $183 million in ETH would represent a significant escalation from the current $840,000 freeze baseline.

Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrency and digital asset markets carry significant risk. Always do your own research before making decisions.