New Bitget Hack Details: ETH Withdrawals Stabilized, $5.7 Billion Reserve Fund, and a User Protection Fund Cut to $200 Million

Bitget’s withdrawal flows have calmed down now that the exchange reopened Ether withdrawals, but the incident is still working through the balance sheet. The part that matters for high-risk PSPs: the exchange is leaning on reserves, a user protection fund, and a patchwork of freezes and blacklists to contain the damage.

1. By the second day, once Bitget allowed withdrawals in Ether as well as bitcoin, the outflow effectively stopped. In the first hours, customers deposited 9,674 ETH and withdrew 9,023 ETH.
2. The exchange’s reserve fund is now estimated at about $5.7 billion, while its user protection fund has dropped from $464 million to $200 million as those funds are being used to cover losses. Gracy Chen said Bitget will replenish the fund from company resources and raise it to more than $300 million within a week.
3. In an interview with Cointelegraph, Chen said she does not expect a full recovery of the stolen funds. She pointed to the Bybit hack in February 2025, when about $1.5 billion in ether was stolen and only $80 million was frozen and recovered — about 3.5% of the total.
4. Chen initially said the attack may have involved North Korean hackers, citing IP addresses that matched the VPN choice of a specific group from North Korea. She now says other explanations are still on the table, including “the possibility of internal collusion.”
5. The hack took place on 24 September, when attackers exploited a vulnerability in a third-party security service. After obtaining credentials, they sent withdrawal commands from the platform’s wallets. Bitget suspended withdrawals immediately, then reopened bitcoin withdrawals on 28 September, Ether withdrawals on 29 September across Ethereum, BSC, Arbitrum, Base and Optimism, USDT withdrawals on 30 September, and plans to restore access to the remaining coins, fiat currencies and p2p operations on 2 October.

Some of the stolen funds were already being laundered through the usual plumbing. Near Protocol tracked multiple attempts to move more than $50 million from the stolen assets and froze $503,000. Tether and Circle blacklisted the wallet linked to the attack and froze $318,013 in USDT and USDC. THORChain, for its part, declined to block transactions, saying its architecture does not allow selective blocking of specific addresses or transfers.