Bitget Hack Moves $387.5 Million as Protection Fund Returns to More Than $300 Million
Key Facts
Bitget said about $387.5 million was transferred to addresses controlled by the attacker in a hack on September 24, 2026, and that its User Protection Fund was designated to cover the incident’s financial impact. Unauthorized transfers began at about 18:31 UTC and involved assets on multiple networks as part of the platform’s hot and warm wallet infrastructure. In its initial update, the company estimated the affected funds at about $351.6 million, saying user balances remained accurate and that the loss was covered by a fund whose declared value at the time exceeded $464 million. It then raised its estimate to $387.5 million on September 25. The company said the new estimate was higher than the initial one, but did not reflect any additional unauthorized transfers after the incident.
Bitget attributed the breach to a vulnerability in a third-party security product that enabled the attacker to obtain highly privileged internal credentials. The company said those credentials allowed forged withdrawal instructions to be sent to the wallet system. In its statement on the investigation, Bitget said an independent review by Mandiant and another by SlowMist found that compromised external security products had enabled unauthorized access to the platform’s wallet environment. The transfers took place across several networks, while the affected area was limited to part of the hot and warm wallet infrastructure. The company said cold wallets were unaffected by the incident.
Bitget said the revision from $351.6 million to $387.5 million followed the addition of assets on the Zcash and TRON networks that had not been included in the initial calculation. The company stressed that including those assets did not mean there had been further unauthorized transfers; rather, it revised the scope of the funds transferred in the same incident that its review covered. This detail places the revised estimate in the context of a broader review of affected assets, not an announcement of a new wave of thefts. On September 25, the platform announced a recovery bounty program. It said an eligible party that directly contributes to the successful freezing or recovery of funds could receive a reward equal to 5% of the frozen funds and 5% of the recovered funds, as applicable.
The amount Bitget said had been frozen remained limited compared with the total funds transferred. In an update carried by CNBC via Yahoo Finance through October 2, the platform said it had frozen about $1.1 million of the nearly $388 million stolen in the attack. The accompanying notice said that freezing assets does not necessarily mean their value has been returned to the platform. The route for compensating the financial impact through the protection fund is therefore distinct from recovering the coins that reached the attacker’s addresses: the company said the fund covered the incident’s impact, while the amount reported as frozen remained about $1.1 million. Bitget did not describe its announcement as direct payments to users, but said their account balances remained accurate and the loss was covered by the fund.
Bitget said the protection fund dates back to 2022, when it was established with an initial value of $300 million and backed by 5,500 bitcoin. After the hack, the company pledged on September 28 to replenish it to at least $300 million within a week. In an announcement dated September 30, it said the fund had returned to more than $300 million and added that the associated wallet addresses were available for on-chain review so users could verify them for themselves. The company did not specify in the public announcement where the funds used to replenish the fund came from; its statement was limited to announcing that it had reached the new value. Publishing the wallet addresses, the company said, allows the fund and its assets to be reviewed and tracked on-chain.
Alongside replenishing the fund, Bitget resumed withdrawals in stages. The company set September 28 at 08:00 UTC for BTC withdrawals, followed by September 29 at 08:00 for ETH withdrawals and September 30 at 08:00 for USDT withdrawals. The schedule set for October 2 covered the remaining tokens, fiat currencies and peer-to-peer services. In an update that day, Bitget said withdrawals for other tokens, along with fiat currency and C2C services, had resumed, confirming completion of the phased recovery plan. It later said withdrawals had returned to normal for all supported assets after the plan was completed on October 2, 2026.