$387.5 million was stolen from Bitget, while its coverage fund was smaller on nearly half the days in 2026: what does it actually cover?

Executive summary

• The User Protection Fund (User Protection Fund), which Bitget says covers the loss, is not a dollar amount but 5,500 Bitcoin, and its value moves with the price. It was worth $464 million on the day of the incident and averaged $382 million in August, below the reported $387.5 million loss. By our calculation, the fund was worth less than this loss on 126 of the 268 days since the start of 2026.
• Not a single Bitcoin has left the fund so far. We reviewed its three wallets directly on the blockchain, the network’s transaction ledger: they hold 5,499.82 Bitcoin, and their latest transaction dates to 12 July. So far, “covers the loss” describes the capacity to pay, not a payment made.
• Paying from the fund would reduce its value below Bitget’s pledged minimum. Since 2022, the company has committed to keeping the fund’s value above $300 million; paying $387.5 million from it would leave only $76.7 million, requiring an additional $223.3 million injection to restore it to the minimum.
• The hardest asset to replace is XRP. We identified on-chain 102.98 million XRP transferred to the attacker address named by Bitget, equivalent to 99.4% of all XRP the platform reported holding in its Proof of Reserve (Proof of Reserve) dated 15 September. This disclosure compares the platform’s holdings of each asset with the amount it owes customers in that asset. All three transfers occurred after the time the company says it detected the breach.
• The real test is still to come: Bitget pledged to announce a withdrawal-resumption plan by 04:00 Coordinated Universal Time (UTC) on 26 September. Customer balances remained unchanged on screen, but a balance that cannot be withdrawn is not the same as an asset held by the customer off-platform.