Bitget Restores Its $300M Protection Fund After the Hack

Bitget has replenished its Protection Fund to more than $300 million, restoring the stated minimum after a security breach drained its hot wallets. Withdrawals are now returning in phases, but the exchange has not finished explaining what happened or how the attack succeeded.

The fund sits apart from the reserves backing customer balances. That separation matters here. It gives Bitget a dedicated buffer for covering losses without reaching into customer accounts, rather than leaving the exchange to absorb an incident with its operating capital.

The Fund Is Back Above Its Minimum

Bitget committed on Sept. 28 to restoring the Protection Fund to at least $300 million within a week. It announced on Sept. 30 that the fund was back above that level, two days ahead of its target.

The Protection Fund was created in 2022 with 5,500 BTC and a stated minimum value of $300 million. Bitget also publishes the fund's wallet addresses, allowing readers to check its holdings on-chain.

There are two important limits to that restoration. The exact value of the replenished fund hasn't been published. Nor has Bitget said whether it is again backed by 5,500 BTC or holds a different mix of assets.

The fund is also below its level before the breach. CEO Gracy Chen said it previously held more than $464 million. Returning it above $300 million restores the stated floor, not the full pre-incident balance.

A Reserve Snapshot Offers Some Support

Bitget's Sept. 30 Proof of Reserves snapshot showed reserve ratios above 100% for all 19 assets included. That's a useful sign that the exchange reported more reserves than customer liabilities for each listed asset at that moment.

It isn't a complete answer to whether users can withdraw every asset, though. A snapshot captures the position at one time, while withdrawals are returning according to a schedule. It also can't replace an independent forensic review of the breach.

Bitget says the incident affected hot and warm wallet infrastructure, while cold wallets and private keys remained untouched. Its incident report says approximately $388 million moved across 12 wallet addresses. The affected assets included XRP, ETH, USDT, ZEC, USDC, USDT0, XAUt, BNB, AVAX and TRX across several networks.

The exchange has raised its estimated loss from about $351.6 million to approximately $388 million. It hasn't explained the roughly $36 million revision.

Withdrawals Return by Asset, Not Account Tier

The restart is staged by asset rather than customer status:

• Bitcoin withdrawals began on Sept. 28 at 8:00 UTC.
• Ether and EVM network withdrawals began on Sept. 29 at 8:00 UTC.
• USDT withdrawals across supported networks began on Sept. 30 at 8:00 UTC.
• Other coins, fiat services and P2P were scheduled for Oct. 2 at 8:00 UTC.

Bitget says the schedule applies equally to every user, with no VIP or account-tier priority. By 09:00 UTC on Sept. 28, it had processed 9,585 Bitcoin withdrawals totaling roughly 4,098 BTC.

The announced Oct. 2 date is a target, not confirmation that every remaining withdrawal had completed.

The Root Cause Is Clearer, the Loss Is Not Closed

Bitget's incident page now attributes the attack to a zero-day vulnerability in a third-party security product. According to the exchange, stolen network credentials allowed the attacker to forge withdrawal instructions and bypass risk controls. Private keys weren't compromised, and cold wallets weren't affected.

That points to a failure around transaction approval and risk controls rather than the theft of cold-wallet keys. It doesn't tell the full story yet. The exchange still hasn't published the promised root-cause analysis, and an independent forensic review is still expected to produce updated reserve information.

Gracy Chen said the Protection Fund absorbed the incident's financial impact and won't pass it on to customer balances. The restoration above $300 million makes that promise easier to examine, but the fund's unpublished composition and exact balance limit how confidently readers can judge its coverage.

So has solvency been restored? The available evidence points in Bitget's favour. Its reserve snapshot shows coverage above 100% for every listed asset, the Protection Fund is back above its own minimum, and withdrawals have resumed. But the fund remains below its pre-incident level, the loss estimate has increased, and the forensic work isn't finished.

For users, the practical test is simpler than the accounting: whether the relevant withdrawal arrives. Bitget has a published schedule for every category, but its own breach history means completion still needs to be judged asset by asset rather than from the announcement alone.