Bitget Rebuilt a $309 Million Protection Fund After a $388 Million Hack. Is Your Crypto Safe on an Exchange?

Hackers stole about $388 million from Bitget, a major cryptocurrency exchange, on September 24, 2026. In response, Bitget has successfully rebuilt its Protection Fund to $309 million. The stolen funds included Bitcoin (CRYPTO: BTC), Ethereum (CRYPTO: ETH), USDT, and other cryptocurrencies. Instead of asking customers to cover the losses, Bitget utilized this fund to compensate for the theft.

After discovering the breach, Bitget temporarily froze withdrawals to safeguard its customers’ assets. Withdrawals resumed on the following dates: Bitcoin on September 28, Ethereum on September 29, USDT on September 30, and the rest of its cryptocurrencies on October 2. Now that the Protection Fund is replenished and withdrawals are active again, one question remains: Is your crypto truly safe on an exchange?

How Hackers Took $388 Million From Bitget, and Why Its Reserves Held

The hackers did not compromise Bitget’s private keys, the crucial codes that allow the movement of coins on a blockchain. Instead, they exploited vulnerabilities in third-party software that Bitget had acquired, stole internal login credentials, and issued fake withdrawal requests. According to CEO Gracy Chen, these fraudulent orders drained the exchange’s hot and warm wallets—those that operate online for quick access—while cold wallets, which remain offline, stayed secure.

This breach occurred just 18 days after another incident where attackers drained about $320 million from the Liquid Network, making September 2026 a particularly costly month for crypto hacks, according to DeFiLlama data.

A critical check on Bitget’s financial health came from its proof of reserves, which showed that it continued to hold more coins than it owed its customers. On September 29, the report detailed that Bitget had 131% coverage overall, including 142% for Bitcoin and 110% for Ethereum. This indicates that Bitget had sufficient assets to back its customer balances.

Bitget’s Protection Fund Paid for the Hack and Now Holds $309 Million

A protection fund is money an exchange sets aside to cover events like hacks. Before the attack, Bitget’s fund was around $464 million but dropped below $200 million afterward as it absorbed the losses. By September 30, the fund had been replenished to $309 million, equating to approximately 3,705 BTC.

However, it still remains about a third smaller than its pre-hack amount. Importantly, Bitget controls this fund based on its internal policies rather than regulatory requirements, meaning customers were covered only because Bitget chose to pay.

When you keep your crypto on an exchange, that exchange controls your private keys, and your balance is essentially a promise to return those coins to you. This is a common practice among many cryptocurrency holders, particularly in the United States. For those who prefer not to use an exchange or hold their private keys, spot Bitcoin ETFs allow an external custodian to manage the coins on the fund’s behalf.

Where the Stolen Bitget Funds Went and Why They May Not Come Back

Unfortunately, most of the stolen funds may not be recovered. Blockchain investigator ZachXBT reported that the launderers sought assistance in public channels like Discord and Telegram. One of them had been involved in laundering money from another significant exploit earlier in 2026.

Some parties attempted to intervene. NEAR Intents, which facilitates swaps between different blockchains, flagged over $50 million in transfers linked to the hack but ultimately froze only around $503,000. Circle and Tether also froze approximately $318,000 in their stablecoins related to the incident.

THORChain, another cross-chain swapping protocol, declined CEO Gracy Chen’s request to block the hackers’ addresses, saying its decentralized design does not allow such actions. In the two days after the hack, THORChain saw trading volume surge to $678 million, far above its typical daily range of $20 to $60 million. Yet THORChain had paused trading after its own $10 million hack earlier in May.

The hackers also transferred 2,746 Zcash (CRYPTO:ZEC), valued at about $3.9 million, into Ironwood, Zcash’s newest shielded pool that provides transaction privacy. This obscures the identity of the sender, recipient, and amount, making it difficult for investigators to track the stolen coins.

Is Your Crypto Safe on an Exchange After the Bitget Hack?

The safety of keeping your crypto on an exchange depends largely on the exchange’s security measures and its capacity to cover any losses. The Bitget hack tested both. Although hackers penetrated Bitget’s defenses, the platform’s Protection Fund and reserves were sufficient to cover all customer balances, and withdrawals reopened within days.

However, this situation highlights that relying on an exchange is ultimately a matter of trust—since the fund is discretionary and controlled by Bitget alone. If Bitget maintains its reserves above 100% and successfully rebuilds the Protection Fund toward its original $464 million, customers have good reasons to stay. Still, if the fund diminishes below $309 million without explanation, the risks may warrant reconsidering where you keep your crypto.

Contact [email protected] for any questions or corrections.