Bitget’s $388 Million Hack Could Consume 84% of Its Protection Fund

Bitget has revised upward the value of assets moved to attacker-controlled addresses in its September 24 hot-wallet breach, raising the estimate from $351.6 million to $387.5 million. The exchange said the increase reflects Zcash and TRON transfers that were missing from its first calculation. At the new figure, the loss amounts to about 83.5% of Bitget's User Protection Fund, based on the exchange's stated valuation of more than $464 million.

A full payout from the fund would leave roughly $76.5 million, below the $300 million commitment Bitget has publicly stated for the reserve, meaning the exchange would need to replenish it. The calculation remains hypothetical: any assets frozen or recovered could reduce the amount ultimately drawn from the fund. Bitget has not disclosed how much has been recovered or how compensation would be funded.

Incident and Fund Mechanics

The breach was detected at 18:31 UTC on September 24, 2026, when Bitget's security systems flagged unauthorized transfers from some hot wallets. The exchange activated emergency response protocols. Its Protection Fund, established in 2022 to cover losses from hacks and similar extreme events, holds 5,500 Bitcoin and is kept separate from reserves backing customer balances. Its dollar value therefore moves with Bitcoin's price; according to Bitget's latest monthly report, the fund averaged $382 million in August, ranging between $345.3 million and $441.5 million.

Mandiant and SlowMist are assisting with the investigation and security checks. Bitget said it has identified the attack path and remediated the underlying vulnerability, with no further unauthorized transfers possible. Some transferred assets have been frozen through coordination with exchanges, blockchain projects and security firms. The exchange also launched a recovery bounty offering eligible participants 5% of assets they help freeze or recover, excluding actions taken under court orders or law-enforcement requests.

CEO Gracy Chen said Bitget holds more than $1 billion of its own assets, but the exchange did not specify how payments would be divided between the Protection Fund and company assets. The value of frozen or recovered assets, the compensation timetable and the pace of any fund replenishment remain undisclosed. Bitget said the status and timing of restored withdrawals would be announced by 04:00 UTC on September 26.

There is no uniform international formula for sizing a voluntary exchange protection fund, and a headline figure does not by itself show its relationship to online wallet holdings or customer liabilities. South Korea requires virtual asset providers to hold insurance or reserves equal to at least 5% of customer assets kept outside cold wallets. That benchmark cannot be applied directly to Bitget because it does not publish the value of customer assets in its hot and warm wallets. For comparison, Binance's SAFU reserve is valued at approximately $1 billion and is also held in Bitcoin.