Crypto24 September, 20262 min read
Bitget Restores $309 Million Protection Fund, Resumes Bitcoin, Ether, Tether Withdrawals
This article is an automated aggregation of coverage from news outlets. Our editorials offer in-depth analysis curated by the NewsCord team.
Protection fund replenished to over $300 million, now at $309 million. Withdrawals for BTC, ETH, and USDT resumed after suspension.
Bitget resumes withdrawals
Bitget restored withdrawals after a September 24 security incident that the exchange said involved unauthorized transfers from parts of its hot and warm wallet infrastructure. Bitget CEO Gracy Chen said the protection fund “absorbed the financial impact of the incident,” as the fund reached $309 million and the exchange resumed withdrawals for bitcoin, ether, and tether. Bitget resumed bitcoin withdrawals on September 28, ether followed on September 29, and tether came back online on September 30, while other cryptocurrencies, fiat currencies, and peer-to-peer services were scheduled to reopen on October 2 at 5 p.m.
Bitget said attackers exploited a vulnerability in a third-party security product to obtain high-level internal credentials and issue unauthorized withdrawal instructions that bypassed risk management controls. Bitget also said its reserve ratio, based on a September 29 snapshot, stood at 131%, meaning the exchange held reserve assets equivalent to 1.31 times the eligible user balances covered by its proof-of-reserves disclosure.
Protection fund and reserves
Bitget said it replenished its user protection fund to $309 million, restoring a safety buffer less than a week after it disclosed a theft of roughly $387.5 million. Bitget’s protection fund, established in 2022 with an initial $200 million and expanded to more than $300 million later that year, was designed to cover user losses from platform-wide incidents, and Bitget said it would absorb the loss through the fund and replenish the amount used. Bitget’s proof-of-reserves update showed an overall reserve ratio of 131% across 19 assets, with all covered assets remaining above the 100% benchmark, and Bitget said users could verify inclusion through a Merkle tree.
Bloomberg Línea reported that Bitget’s “Protection Fund” referenced to assure customers that their funds were safe had fallen below US$200 million, citing three wallet addresses Bitget cited as sources of the funds. Bloomberg Línea also reported that Bitget CEO Gracy Chen said, “Bitget will replenish the Fund using its own capital, with the aim of the Fund exceeding US$300 million within a week.”
Freezing, bounties, and disputes
Bitget traced $387.5 million in unauthorized transfers from hot and warm wallet infrastructure and patched the vulnerability and implemented additional measures to prevent further unauthorized transfers. NEAR Intents said its SHIELD detection system blocked more than $50 million in attempted transfers tied to the attacker and froze $503,000 during execution, while about $166,000 in suspected stolen funds passed through before being identified. Alex Shevchenko, general manager of NEAR Intents, said the protocol “will not claim the bounty Bitget offered for freezing or recovering attacker-linked funds,” and he said frozen funds would be returned through a legal process.
Bitget publicly called on THORChain to refuse services to addresses associated with the attack, and THORChain responded that it “doesn't censor by design,” while noting it had halted its network in past emergencies as broad security actions. Circle and Tether blacklisted a wallet connected to the exploiter, freezing $318,013 in USDC and USDT, and Bitget also offered a 5% reward for freezing assets and an additional 5% for recovery.