Bitget rebuilds $300M protection fund six days after $388M breach
Bitget said its $300 million Protection Fund, a self-funded onchain reserve separate from customer balances, has been restored to its full minimum level after absorbing the financial impact of a Sept. 24, 2026 security breach. For institutional investors weighing exchange counterparty risk, the episode tests whether a major platform’s internal insurance mechanism can absorb a nine-figure loss without touching user funds or reserve ratios.
- Bitget’s Protection Fund absorbed roughly $388 million in impact from the Sept. 24, 2026 breach, the exchange said.
- Bitget pledged on Sept. 28 to rebuild the fund to $300 million within a week and completed it two days early, on Sept. 30.
- The exchange’s Sept. 30 Proof of Reserves showed a 131% overall ratio across 19 assets, each above the 100% benchmark.
- $388M financial impact the fund absorbed from the Sept. 24 breach
- 131% reserve ratio across 19 assets versus the 100% benchmark
- 5,500 BTC initial 2022 funding that set the fund’s $300M floor
Bitget said in a Sept. 30, 2026 (Wednesday) announcement that it had replenished its Protection Fund to more than $300 million, restoring the backstop six days after the Sept. 24, 2026 (Thursday) breach cut roughly $388 million from its value. The fund is a separate reserve Bitget established in 2022 with 5,500 BTC, distinct from the Proof of Reserves that backs customer account balances, designed to cover losses from platform-wide incidents rather than a user’s own trading errors.
The exchange said customer balances stayed accurate and unaffected throughout the incident, a point first detailed in cryptoslate.com’s report on the replenishment. Bitget had pledged on Sept. 28, 2026 (Monday) to rebuild the fund within one week; it delivered two days ahead of that deadline.
Bitget’s CEO Says the Fund “Absorbed the Financial Impact” of the Breach
Bitget CEO Gracy Chen framed the restoration as evidence the backstop functions as designed, rather than as a standalone marketing claim.
The Protection Fund was created for moments like this and absorbed the financial impact of the incident. We said we would bring it back to at least $300 million within a week, and we have done that. Users can verify the fund themselves onchain, just as they have been able to since it was established.
Gracy Chen, CEO, Bitget
Bitget said it has engaged independent cybersecurity firms Mandiant and SlowMist for forensic investigation into the breach, with fund tracing and recovery efforts continuing separately from the replenishment. Crypto Coin Show’s earlier coverage of the incident cited a $464 million protection fund and a $351.6 million hot wallet breach; those figures differ from Wednesday’s $388 million impact and $300 million floor, reflecting the fund’s fluctuating BTC-denominated valuation.
Proof of Reserves Shows 131% Ratio, a Separate Metric From the Fund
Bitget’s 47th Proof of Reserves update since the program began in December 2022 reported a 131% reserve ratio across 19 covered assets, each above the 100% benchmark, from a snapshot taken at 09:00 UTC on Sept. 29. That figure backs customer account balances and sits apart from the Protection Fund, which under its published fund conditions covers losses from platform-wide incidents and remains subject to Bitget’s own claim assessment and investigation process.
A 2023 advisory from the PCAOB’s Office of the Investor Advocate cautions that proof-of-reserves reports are not audits, can omit liabilities or borrowed assets, and offer no assurance about asset availability beyond the moment measured. For institutional buyers, that means the 131% figure describes a single Tuesday morning, not an ongoing solvency guarantee, and must be read alongside the separate Protection Fund rather than in place of it.
The scale of the Sept. 24 incident dwarfs most other recent sector breaches, including the $36 million hack that crashed Humanity Protocol’s token more than 80% and is detailed in Crypto Coin Show’s reporting. A reserve large enough to absorb $388 million without touching customer balances changes the counterparty math for institutions sizing exchange exposure.
Remaining Withdrawals Target Friday, Oct. 2 at 08:00 UTC
Bitget’s Sept. 30 service notice said USDT withdrawals reopened on Ethereum, BSC, Solana and Tron, the first phase of its restoration timetable. The notice does not address the other assets or services still paused since the breach.
The exchange’s incident timetable sets Friday, Oct. 2, 2026 at 08:00 UTC for restoring the remaining cryptocurrencies, fiat and peer-to-peer services. That date is today, making full service restoration the next milestone Bitget still owes customers beyond the fund replenishment it has already reported.
The CCS read. We’d flag that a restored headline number doesn’t settle individual claims. Bitget still reserves the right to assess and investigate each account before paying out, so affected users face a case-by-case process even as the fund shows $300 million onchain. The fund’s daily midnight-UTC valuation also means its real coverage still moves with bitcoin’s price, not a fixed dollar guarantee.
Bitget’s incident timetable now turns to the Oct. 2, 08:00 UTC deadline for remaining cryptocurrencies, fiat and pe
