Bitget CEO Expects Little Recovery From $388M Hack
Bitget says about $1.1 million has been frozen after its $388 million hack, while its protection fund is replenished and investigators trace the breach.
Key Notes
- Bitget CEO Gracy Chen expects limited recovery from the roughly $388 million hack, with about $1.1 million frozen rather than confirmed returned.
- The exchange has restored its Protection Fund above $300 million and reports a 131% reserve ratio across 19 covered assets.
- Preliminary investigations identify compromised third-party security products and a customized tool used to trigger fraudulent withdrawals.
Bitget CEO Gracy Chen expects limited recovery from the roughly $388 million stolen in last week’s hack, despite a small portion of the missing assets being frozen.
About $1.1 million has been frozen, Chen told CNBC in an email interview. Frozen assets have not necessarily been returned to the exchange, and she did not disclose a recovered total.
Protection Fund Restored Above $300 Million
Bitget announced on September 30 that it had replenished its Protection Fund to more than $300 million, ahead of the one-week deadline it set two days earlier. The exchange says this fund is separate from the reserves backing customer balances.
The company maintains that user balances were protected throughout the incident. Replenishing the fund and recovering stolen assets are separate developments: rebuilding a financial buffer does not mean the missing tokens have been retrieved.
In its latest reserve update, Bitget reported an overall reserve ratio of 131% at 09:00 UTC on September 29. All 19 covered assets were above 100%, including Bitcoin at 142%, Ether at 110% and USDT at 107%.
Those figures are the exchange’s reported snapshot of covered assets and customer balances. They should not be treated as a comprehensive independent audit of every liability or a guarantee that further security incidents cannot occur.
Security Products Became an Entry Point
Bitget released preliminary investigations by Mandiant and SlowMist on September 30. Mandiant’s report describes privileged access to two third-party security appliances, followed by movement into a production wallet server and the installation of malicious software.
SlowMist’s findings trace the earliest malicious activity in available logs to August 31, involving a zero-day vulnerability in one security product. Investigators also recovered a customized tool that forged risk-control parameters and invoked the wallet system’s withdrawal process.
Mandiant records Bitget’s statement that it had not observed evidence of compromised private keys and that cold wallets were unaffected. The investigations remain ongoing; neither published report provides a formal attribution to a particular attacker.
Withdrawal Restart and Recovery Efforts Continue
The exchange’s loss estimate rose from $351.6 million to $387.5 million after it included previously uncounted Zcash and TRON assets. As covered in CoinScreamer’s withdrawal update, that revision did not represent a second breach.
Bitcoin, Ether and USDT withdrawals have resumed, according to CNBC. Bitget’s published schedule sets the remaining token withdrawals, fiat services and peer-to-peer trading for restoration at 08:00 UTC on October 2.
Bitget is also offering a 5% bounty for eligible voluntary actions that lead to funds being frozen or recovered. Its stated exclusions include freezes or recoveries compelled by court orders, law enforcement or other legal processes.
Disclaimer: CoinScreamer is an independent media brand owned and operated by NuvexMedia LLC, publishing news, research, and market insights on digital assets and related technologies. NuvexMedia LLC invests in and collaborates with companies across the digital asset, blockchain, and technology sectors. These relationships do not influence CoinScreamer’s editorial coverage, and the publication maintains full editorial independence to provide accurate, timely, and objective information. © 2025 NuvexMedia LLC. All rights reserved. This content is for informational purposes only and should not be considered legal, tax, investment, financial, or other professional advice.
