Bitget rebuilds $300M protection fund after $388M breach

Bitget restored its Protection Fund to more than $300 million on Sept. 30, 2026, absorbing the $388 million impact of a Sept. 24 security breach, according to Cryptoslate. The exchange says the fund is separate from customer reserves and that customer balances remained accurate, but users still face staged withdrawal timelines and a claims process that Bitget controls.

Bitget announced that it had fulfilled a Sept. 28 pledge to return the fund to at least $300 million within a week, completing the replenishment two days after that commitment. The release does not quantify how much new capital was contributed, and the fund’s displayed valuation uses prices at midnight UTC each day, per Bitget’s fund page. The exchange also reported a 131% reserve ratio across 19 covered assets in a snapshot taken at 09:00 UTC on Sept. 29.

Withdrawals restart in phases as CEO doubts recovery

Bitget began resuming withdrawals in stages, starting with Bitcoin (BTC) on Monday and continuing with ETH on Tuesday, then opening USDT on four networks. A Sept. 30 service notice said USDT withdrawals were live on Ethereum, BSC, Solana, and Tron, while the rest of the exchange’s crypto, fiat, and peer-to-peer services are set to open on Oct. 2 at 08:00 UTC.

In an interview on Cointelegraph’s Chain Reaction released Tuesday, Bitget CEO Gracy Chen said she was not very optimistic about recovering the stolen funds, using the February 2025 Bybit hack as a reference point. Bybit lost about $1.5 billion worth of Ether, and the company reported freezing and recovering a combined $80 million. Chen noted that after a year, Bybit had frozen only about 3.5% of the total stolen funds, and that freezing was separate from recovery.

Bitget launched a bounty program offering 5% of funds frozen and 5% for those recovered. The team behind NEAR Intents said Monday it blocked more than $50 million in assets tied to the attack and froze about $500,000, while Chen confirmed Tether and Circle blacklisted a wallet linked to the exploit, freezing $318,013 in USDT and USDC. The breach is one of the largest to hit the crypto industry in 2026, following a $320 million exploit of the Liquid Network in September.

Chen also addressed responsibility for the attack. She said immediately after the incident that North Korea may have been responsible, based on IP addresses that matched VPN choices by a certain DPRK group, but added that Bitget had not totally ruled out an inside job, noting that a complicated investigation was still underway.

What the fund does and does not cover

Under Bitget’s published fund conditions, users may submit claims when accounts are compromised or assets are stolen or lost through platform-wide events not attributable to their own actions or trading behavior. The exchange retains the right to assess claims and investigate affected accounts or assets, with outcomes subject to its findings. Eligibility to submit a claim does not guarantee reimbursement of a particular loss.

The reported replenishment does not remove that assessment process or establish that compensation has been completed. Bitget’s reserve report gives an overall ratio of 131% across 19 covered assets, each above 100%, for a snapshot taken at 09:00 UTC on Sept. 29. A 2023 advisory from the PCAOB’s Office of the Investor Advocate noted that proof-of-reserves reports are not audits, may omit liabilities or borrowed assets, and cannot assure subsequent asset availability. Bitget reports a $300 million-plus protection fund, 131% reserves, and phased withdrawal restoration, though reserves remain a snapshot.

The reports differ in emphasis: Cryptoslate focuses on the Protection Fund restoration and the staged withdrawal timetable, noting that claims remain subject to Bitget’s assessment, while Cointelegraph concentrates on CEO Gracy Chen’s comments about the difficulty of freezing and recovering funds, and on third-party efforts to block stolen assets. Both accounts agree on the ~$388 million loss figure and the phased withdrawal schedule.

Why it matters

For Bitget users, the protection fund restoration is a solvency signal, but it does not guarantee that individual claims will be paid, since Bitget retains discretion over assessments. The 131% reserve ratio snapshot offers some reassurance, yet proof-of-reserves reports are not audits and may not capture liabilities or borrowed assets. The breach underscores that even large exchanges with backstop funds and bounty programs face lengthy recovery processes, as Bybit’s experience showed. Customers should treat the fund announcement as separate from their own claim status.

What to watch

The next concrete milestone is Oct. 2 at 08:00 UTC, when Bitget’s remaining cryptocurrencies, fiat, and peer-to-peer services are scheduled to open, according to its service-opening notice. Ongoing developments include the outcome of Bitget’s claims assessment process and any further asset freezes or recoveries from the bounty program. This is not financial advice; the crypto market is volatile and uncertain.

Sources: CryptoSlate, Cointelegraph