- Bitget's protection fund holds 5,500 bitcoin, while the $387.5 million taken from its hot wallets on 24 September 2026 was ether, XRP, Zcash, stablecoins and other coins, with no bitcoin among them.
- Because the fund and the loss are different coins, at 25 September prices the fund outweighs the revised loss only while bitcoin trades above about $70,455, and Bitget alone assesses every claim against it.
- An exchange protection fund covers a loss down to a price, on a date and at the exchange's own discretion, so a "covered" announcement says little about a balance until it comes with all three.
Bitget's answer to losing $387.5 million is a number: 5,500 bitcoin. None of the coins that left its hot wallets on 24 September were bitcoin. Is Bitget safe after that? The exchange says customer balances are protected and the fund covers the loss, and it said so while its count still stood at $351.6 million. As of 25 September, deposits and trading are open. Withdrawals stay paused until a plan Bitget has promised by 04:00 UTC on 26 September.
That fund is the whole of the exchange's reply, so it is worth reading slowly. What left was ether, XRP, Zcash, BNB, AVAX and TRX, plus three dollar stablecoins and a token backed by gold. The fund's dollar size rises and falls with bitcoin. The cost of replacing what was taken rises and falls with everything else, which turns "covered" into a statement about prices on a particular day.
Lilith gave twenty years to cybersecurity before she left it for art, and she still reads an incident from its far end. Its loud first hours tell her little. What she watches is where the power settles once the drama leaves, which after a hack comes down to who decides what you get back. So she reads Bitget's promise the way she once read a breach report, line by line and against what you actually hold.
She starts with your account. Say it holds 2 ETH and 1,000 USDT, bought over the summer and left on the exchange. Your app still shows both to the last decimal. "That screen is a list of what Bitget owes you," she says. The coins behind the list are another matter. Bitget keeps them in its own wallets, pooled with other customers' coins, and some of those wallets were drained on Thursday evening. Lilith wants to know what refills them, and who decides that.
What is Bitget's protection fund made of?
Lilith reads the fund page twice, once for the number and once for the terms. The number is simple. It is 5,500 BTC, and the fund's dollar value is reset each day from bitcoin's price at midnight UTC. Bitget started it in 2022 with $300 million of its own money. Its August report adds a floor: the company is committed to keeping the fund's value above that figure.
The terms take longer, because they decide more than the number does. Users hit by "platform-wide events not attributable to their own actions or trading behavior may make a claim," the fund page says. That line also rules things out. A loss that traces back to your own trading, or to a password you gave away, falls outside it. Then come the conditions. Bitget "reserves the right to assess each claim," and every claim is "subject to the investigation results" of an inquiry the exchange runs itself.
"Count the parties in that sentence," Lilith says. "There's one." The company that lost the coins decides what a claim is worth, and whether there is a claim at all. A bank deposit works the other way round. A separate body pays out under rules written into law, and deposit insurance does not reach crypto held on an exchange.
For your balance, nothing has been asked of you this week. Bitget says every balance is accurate, which puts the hole in the exchange's own wallets rather than in your account. The exchange has chosen to cover that hole with the fund, and the page's own wording makes plain that it was a choice.
Protection of this kind is a decision the exchange keeps making, not a right you can hold it to.
Its choice of coin does have a real strength, and Friday's prices show it. Bitget's own token, BGB, slid about 4% in a day while bitcoin barely moved. A fund held in BGB would have shrunk on the very day it was called on, a safety net woven from the reputation it exists to protect. Bitcoin doesn't care what happens to Bitget. That independence is what the choice buys.
"It's the right coin for a fund," Lilith says. "It just isn't the coin that was taken."
At what bitcoin price does the cover run out?
"At what price does the fund stop covering the loss?" Lilith asks. On Friday afternoon bitcoin traded at $83,805, which made the fund worth about $461 million and put the revised loss at 84% of it. Divide each loss figure by 5,500 and you get the bitcoin price at which the fund and the loss are the same size.
| Loss figure | Bitcoin price at which 5,500 BTC equals it | How far below bitcoin's 25 September price ($83,805) |
|---|---|---|
| First estimate, $351.6M (24 September) | $63,927 | 23.7% |
| Revised estimate, $387.5M (25 September) | $70,455 | 15.9% |
| Revised estimate if the stolen coins gain 10% on bitcoin (illustrative) | $77,500 | 7.5% |
One day of recounting took a third of the margin away. Bitget says the revision reflects a fuller count of the same transfers, adding Zcash and TRON amounts the first estimate missed. By that account nothing new left the wallets, and the line still rose by more than $6,500.
The line doesn't hold still after that either, because the loss is a basket of other coins with prices of their own. Over the same day XRP rose almost 6% and Zcash almost 4%, while bitcoin slipped. Whatever share of the loss those two make up cost more bitcoin to replace on Friday afternoon than it had a day earlier.
Your own balance runs the same arithmetic at a smaller size. On Friday one bitcoin bought about 31 ether, so the fund was worth roughly 171,000 ether. Putting ether back behind balances like yours takes ether. If the fund's bitcoin pays for it, each coin buys whatever the ratio allows on the day it is spent. Should ether gain 10% on bitcoin, your two cost 10% more bitcoin to replace, while the fund stays exactly the size it was.
Bitget owes you two ether, not $5,385.
Had the balance been bitcoin, the arithmetic would be shorter. No bitcoin was on the list, so none of the coins behind a bitcoin balance left the wallets. A bitcoin holder still shares the exchange and the fund with the holders whose coins did leave. That is why the fund's price matters to every balance on the platform.
Bitget's August report shows how far bitcoin travels by itself. It puts the fund at $345 million on 1 August and $441 million on 27 August, and bitcoin's own climb over those weeks accounts for the gap. At the low, bitcoin sat under $63,000, below even the first estimate's line.
A second limit outlasts any price. The fund is a stock of coins that nothing refills on its own, so whatever it pays for this breach is gone before the next one. Paying the whole revised loss at Friday's price would leave about 876 bitcoin, roughly $73 million, well under the $300 million floor the company has committed to. Bitget has said the incident's losses are covered. It hasn't said how: whether bitcoin will be sold, the fund topped up, or the hole paid from somewhere else.
"Watch the coin count on that page, not the dollars," Lilith says. "The dollars move every day. The count only changes when somebody decides it should."
Is Bitget safe while withdrawals are paused?
You tap withdraw and the app refuses. Bitget stopped withdrawals "as a precautionary measure, pending security review," when its systems flagged the transfers on Thursday evening. Deposits and trading kept running. So your two ether can still be sold for dollar tokens. Your thousand USDT can still buy bitcoin, at any hour you like.
Every one of those trades stays inside Bitget's own books.
That split follows the attack. A trade only changes numbers on the exchange's ledger. A withdrawal is a transaction the wallet system builds, approves and sends out, and that system is where the break-in happened. Bitget's chief executive, Gracy Chen, says the attacker compromised a backend system inside the wallet infrastructure. From there it spoofed transaction data and got the exchange's own authorization process to move the funds.
"The approval step approved it," Lilith says. "So the approval step stays shut until they can trust it again." Chen has said the exchange will not commit to a window it cannot guarantee.
A shut exit also changes the market you trade in. Deposits still work, so if a coin trades higher on Bitget than elsewhere, anyone can send some in and sell it, and the gap closes. Going the other way takes a withdrawal. Nobody can buy a cheap coin on Bitget and carry it out to sell elsewhere. While the pause lasts, a price there can sit below the rest of the market with nothing pulling it back up.
If yours is the balance behind that refused button, the waiting is the hard part, and no statement makes it shorter. Is the balance safe in the meantime? On the ledger it hasn't moved, and Bitget says it is accurate. What a pause changes is not what you own but who decides when an entry on that ledger becomes a coin you hold. For now the exchange makes that decision alone.
It made that decision on quiet days too. The withdrawal button is the switch every exchange keeps, and weeks like this one are when you can see a hand on it.
Why did the attacker pay extra to hold ether?
Lilith's favorite detail in the on-chain record is a bad trade. A fresh wallet spent about $20 million of USDT0, a cross-chain version of Tether's dollar token, on 7,111 ether in six minutes. An on-chain tracker quoted by Decrypt clocked it paying up to 5% above the market price. Even a few percent of that is a lot to throw away.
"Nobody pays 5% over the market without a reason," Lilith says. "They were paying to get out of coins that have an owner." A dollar stablecoin has an issuer, a company that can freeze its token at an address. Ether has no issuer to ask. It was also the obvious place to run. Ether is the largest coin on the stolen list, and its market is deep enough to take $20 million in six minutes, at a price.
The issuers moved within a day. Circle and Tether froze their tokens in one of the attacker's wallets, leaving about $318,000 in dollar stablecoins stuck there, CoinDesk reports. Other attacker addresses hold more than 63,000 ether, which no issuer can freeze. At Friday's price that is about $170 million, some 44% of the revised loss.
Even inside the frozen wallet, the 170 ether sitting beside those tokens stayed free to move.
The gap between those two outcomes is what an issuer freeze can reach. It covers the tokens an issuer controls and nothing sitting next to them in the same wallet. Bitget's bounty puts a price on that reach: 5% of whatever someone helps freeze, and another 5% of whatever they directly help recover.
For the hole behind your balance, this decides which coins can come back. The frozen dollar tokens might, through whatever process their issuers run. The ether the attacker bought won't come back unless someone returns it, so the fund has to carry the coins nobody can stop. Your own thousand USDT carries that same switch. It worked in Bitget's favor this week, and it comes with every issuer-run dollar token you hold.
The attacker has also put a price on an issuer's off switch: about 5%, the most candid valuation anyone has offered this week.
Covered is a price and a date
Lilith leaves the fund page open beside your balance. The loud hours are over, and she can see where the power settled. It sits with the company that holds the coins and judges the claims, with the issuers who froze what they could, and with a bitcoin price nobody controls. She has no verdict on Bitget to hand you, and the arithmetic wasn't built to produce one, only to read the word covered.
Covered, from a fund like this one, means down to a price, on a date, at the owner's discretion.
On the fund page, the coin count will show whether any bitcoin left the fund. The withdrawal plan will show when your two ether can become coins in a wallet you control, and the price line will keep moving whether anyone writes about it or not.
A slower signal comes from Bitget's reserve report. The last one, published on 16 September, put its total reserve ratio for August at 122%. It counted the protection fund separately and was taken before the attack. A reserve report records a level on one day. The next one is the first that can show whether the hole behind the balances was filled. For an exchange you haven't used yet, the checks to run before a deposit come before any of this.
The word will turn up in the next exchange's announcement too, and it will be exactly as true as the price it was written at.
Split a $5,000 paper balance evenly between bitcoin and ether in the simulator. Check the pair once a day for a week and note how many ether one bitcoin buys each time. That ratio decides how far a fund held in bitcoin stretches against a debt owed in ether, and while the dollars here are simulated, the ratio is the market's own.
