Bitget’s $388 Million Hack Could Consume 84% of Its Protection Fund

Bitget has raised its estimate of assets transferred to attacker-controlled addresses from $351.6 million to $387.5 million, adding transfers through Zcash and TRON that were missing from the first calculation.

London's trading industry is coming home!

The revised figure is about 83.5% of its User Protection Fund, based on the exchange’s stated valuation of more than $464 million. Bitget would then need to replenish the reserve to restore it above its stated $300 million commitment.

The calculation remains hypothetical because frozen or recovered assets could reduce the amount ultimately required from the fund.

[SECURITY NOTICE] Bitget Hot Wallet Incident — September 24, 2026At 18:31 UTC on September 24, 2026, Bitget's security systems detected unauthorized transfers from some of our hot wallets. Our security team activated emergency response protocols immediately.What we have…

— Gracy Chen @Bitget (@GracyBitget) September 24, 2026

Fund Value Moves with Bitcoin

Bitget established the Protection Fund in 2022 to cover losses from hacks and other extreme events, such as the September 24 breach of part of its hot- and warm-wallet infrastructure.

The fund holds 5,500 Bitcoin and is separate from the reserves backing customer balances. Bitget says the incident falls within its coverage. Its dollar value fluctuates with Bitcoin.

The fund averaged $382 million in August, ranging from $345.3 million to $441.5 million, according to Bitget’s latest monthly report.

Frozen Assets May Reduce the Final Cost

Mandiant and SlowMist are assisting with the investigation and security checks. Bitget said it has identified the attack path and remediated the underlying vulnerability, with no further unauthorised transfers possible.

We’re working closely with @bitget on the ongoing investigation. For further details, please refer to Bitget’s official updates. https://t.co/bFckgAnS9I

— SlowMist (@SlowMist_Team) September 25, 2026

Some of the transferred assets have been frozen through coordination with exchanges, blockchain projects and security firms. Bitget has also launched a recovery bounty offering eligible participants 5% of assets they help freeze or recover.

Actions taken under court orders, law-enforcement requests or other legal processes do not qualify.

CEO Gracy Chen said Bitget also holds more than $1 billion of its own assets; however, it did not say how any payments would be divided between the Protection Fund and its own assets.

The value of frozen or recovered assets, the compensation timetable, or how quickly the fund would be replenished are also undisclosed. The status and timing of restored withdrawals will be announced by 04:00 UTC on September 26.

Fund Size Is Not Tied to Disclosed Wallet Exposure

No uniform international formula determines how large a voluntary crypto exchange protection fund should be.

A fixed headline amount does not show its relationship to assets held in online wallets, customer liabilities, the potential loss from a single breach or the liquidity of the reserve.

South Korea provides one risk-based benchmark. Its rules require virtual asset providers to obtain insurance or hold reserves equal to at least 5% of customer assets stored outside cold wallets, subject to a minimum amount.

The benchmark cannot be applied directly to Bitget because the exchange does not publish the value of customer assets held in its hot and warm wallets.

For comparison, Binance maintains a SAFU reserve valued at approximately $1 billion. Like Bitget’s fund, it is held in Bitcoin, and its dollar value therefore changes with the cryptocurrency’s price.

This article was written by Tanya Chepkova at www.financemagnates.com.