CEO Gracy Chen says the exchange covered compromised wallets through its protection fund, then replenished it from company reserves after the September attack.
Bitget replenished its protection fund with more than $300 million from company reserves after September’s cyberattack, CEO Gracy Chen told Fortune in an account published on October 28. It had first drawn on the fund to cover compromised wallets.
The account follows the September 24 attack, which Bitget says affected 12 wallet addresses and forced it to suspend withdrawals. The company puts the loss at $388 million and calls that its final verified figure.
| Measure | Amount and status |
|---|---|
| Assets stolen | Nearly $388 million; Bitget puts the figure at $388 million. |
| Company reserves contributed to replenish the fund | More than $300 million, Chen says. |
| Restored protection fund balance | Above $300 million, Bitget announced on September 30. |
The reserve contribution was company-funded loss coverage, not money recovered from the attackers. Chen did not give a separate reimbursement total. Bitget says it designated the fund to absorb the attack’s financial impact and kept user account balances accurate and unaffected.
The W27 keeps the Galaxy Z Fold 8 Ultra’s core hardware, with dark-red or dark-blue finishes, golden accents and 16GB of working memory in both storage versions.
2 min
Bitget established the protection fund in 2022 to safeguard user assets against extreme market events or security breaches not caused by user misconduct. The company says this additional safeguard is separate from the reserves backing customer balances. On September 28, it committed to restoring the fund to at least $300 million within a week; its September 30 announcement said it had met that commitment.
Bitget says unauthorized transfers began at 18:31 UTC on September 24 from some hot and warm wallets used to process transfers. Its systems detected discrepancies at 19:05 UTC and automatically blocked withdrawal requests across the platform. The affected funds spanned 12 crypto assets across 11 blockchains, the networks that record their transactions.
Although Bitget says account balances were protected, customers temporarily lost access to withdrawals. The company says trading and deposits continued, withdrawals reopened in stages, and all withdrawal services were restored on October 2.
Chen said some customers had left after the attack. She described the number as not significant but said she wanted to win those users back, with asset security their main concern.
Bitget says attackers exploited a flaw in a third-party security product to steal internal access credentials, forge withdrawal instructions and bypass controls. Its cold wallets, which held most platform assets, were unaffected and no private keys—the secret credentials used to authorize crypto transfers—were compromised.
The exchange says it fixed the vulnerabilities, reset internal credentials, restricted sensitive permissions, disabled the affected third-party functionality and strengthened withdrawal checks. It engaged cybersecurity firms Mandiant and SlowMist to investigate. Both firms released reports on September 30 identifying the compromised third-party product as the route into its wallet systems.
Recovery of stolen assets remains a separate effort from covering customer losses. Bitget says tracing, recovery and longer-term security upgrades continue. Bitget has not disclosed how much, if any, has been recovered or frozen. Its recovery programme says eligible helpers may receive 5% of funds frozen or recovered if their voluntary assistance directly produces that result.
The satellite operator expects access to more than twice OneWeb’s current bandwidth in return for spending in 2027–2034, with initial IRIS² services expected from 2030.
3 min
The black, gold and green edition follows September’s sold-out preorders. Nintendo’s replenished launch-day stock also quickly sold out.
1 min
