Community Trust ScoreVerified
Bitget got hit hard. The exchange confirmed that $387.5 million in assets moved to attacker-controlled addresses after a breach on September 24 — and that figure now represents roughly 83.5% of its User Protection Fund, a reserve valued at just over $464 million.
The fund holds 5,500 Bitcoin and has been in place since 2022. It was built specifically for extreme events, the kind of scenario nobody wants to actually test. But here we are. Because the fund sits in Bitcoin, its dollar value swings with the market — it averaged $382 million in August, with a range running from $345.3 million to $441.5 million over that same month. So the $387.5 million theft doesn’t just threaten the fund’s headline figure. It threatens the fund’s ability to fully cover losses depending on where Bitcoin is trading on any given day.
The breach targeted Bitget’s hot- and warm-wallet infrastructure.
Emergency Response and the Bounty Offer
Investigators spotted the breach at 18:31 UTC on September 24. Bitget moved fast — emergency protocols went live immediately. The exchange brought in Mandiant and SlowMist to assess what happened and shore up vulnerable points in the system. Some stolen assets have already been frozen through coordination with other exchanges and security firms. Not all of them. Some.
Bitget also put out a 5% recovery bounty for anyone who helps freeze or recover stolen funds. Eligible participants can claim it — but actions taken under legal orders don’t qualify. The source didn’t specify what “eligible participants” looks like in practice, or how that determination gets made.
CEO Gracy Chen’s Response and What’s Still Unknown
CEO Gracy Chen said Bitget holds over $1 billion in assets. She didn’t get into specifics about how much of that goes toward compensation or when the fund might be replenished. The exact split between the Protection Fund and the company’s own balance sheet — in terms of who pays what — hasn’t been disclosed either.
Withdrawal status updates were expected by 04:00 UTC on September 26. That’s a short window, and users were watching it closely.
What’s still murky: the full extent of frozen or recovered assets, the timeline for any compensation, and whether the fund can cover the full loss without Bitget dipping into its own reserves. Chen’s $1 billion figure is probably meant to reassure, but the math here is uncomfortable. If 83.5% of the Protection Fund is gone and Bitcoin slides, the fund’s remaining value shrinks further. The company hasn’t explained how it handles that scenario.
No Global Standard for Crypto Safety Funds
There’s no universal rule for how big a protection fund needs to be. South Korea requires virtual asset providers to hold reserves or insurance equal to at least 5% of customer assets held outside cold wallets — but that benchmark doesn’t apply to Bitget directly. It’s a useful reference point, not a binding standard.
Binance runs a $1 billion SAFU reserve, also held in Bitcoin, which means it faces the same volatility problem. When Bitcoin drops 20%, so does the fund. That’s a structural issue across the industry, not just a Bitget problem.
Bitget doesn’t publicly disclose how much of its customer assets sit in hot and warm wallets, so there’s no clean way to benchmark its fund against South Korea’s 5% rule or any other metric. The numbers that would make the comparison meaningful just aren’t available.
And that’s kind of the core tension here. Exchanges set up protection funds to reassure users. But when the fund’s value fluctuates with the same asset it’s supposed to protect against losing, and when the size of the fund isn’t anchored to any disclosed liability figure, the reassurance is harder to evaluate than it looks.
Bitget’s coordinated freezing effort — working with exchanges and blockchain projects — is the clearest concrete action so far. It’s the right move. Freezing stolen assets before they get laundered or converted is the best shot at reducing actual losses. But the timing matters enormously in these situations, and the source didn’t specify how quickly those freezes happened relative to the breach itself.
The investigation is ongoing. Mandiant and SlowMist are still working through it. More frozen assets are possible. So is more bad news.
Withdrawal updates were due by 04:00 UTC on September 26.
Frequently Asked Questions
How much was stolen in the Bitget hack?
Bitget confirmed that $387.5 million in assets moved to attacker-controlled addresses during the breach on September 24, which represents roughly 83.5% of its User Protection Fund valued at over $464 million.
What is Bitget’s User Protection Fund and how big is it?
The User Protection Fund holds 5,500 Bitcoin and was set up in 2022 to cover extreme events. Its dollar value fluctuates with Bitcoin’s price — it averaged $382 million in August, ranging from $345.3 million to $441.5 million that month.
Who is investigating the Bitget breach?
Mandiant and SlowMist joined the investigation after the breach was detected at 18:31 UTC on September 24. Bitget is also coordinating with other exchanges and security firms to freeze stolen assets.
Why It Matters
The significant loss of 83.5% of Bitget's User Protection Fund underscores the vulnerabilities that centralized exchanges face in an increasingly complex threat landscape. Such breaches not only erode user trust but also raise alarms about the adequacy of security measures within the crypto industry, potentially impacting overall market confidence and regulatory scrutiny. As exchanges grapple with these risks, the incident may catalyze discussions around improving security protocols and the need for more robust insurance mechanisms for user assets.
