Bitget Refills $300M Protection Fund Two Days Early After $388M Breach Hit

Bitget says its Protection Fund is back above $300 million after absorbing a $388 million hit from a Sept. 24 security breach, and the exchange got there two days ahead of its own deadline.

Nine days, one breach, one deadline

The clock started Sept. 24. That's when the breach landed. Bitget hasn't detailed the mechanics in this disclosure, but the financial shape is now public. Roughly $388 million in impact, swallowed by the fund rather than by customer balances.

Four days later, on Sept. 28, the exchange went public with a commitment. The fund would be back to at least $300 million within a week. Not "soon." A week.

Then came Sept. 29 at 09:00 UTC, the reference point for Bitget's reserve snapshot. Nineteen covered assets, an overall ratio of 131%, every single asset above 100%. That's the unglamorous part of the story. It's also the part that matters most if your money is sitting on the platform.

Sept. 30 delivered the headline. Fund restored, above $300 million, two days early. Same day, USDT withdrawals reopened across four networks. Ethereum, BSC, Solana, Tron. Not all of them. Four.

So the sequence is clean. Breach, pledge, reserve snapshot, replenishment. Deadline met with room to spare.

But notice what didn't get disclosed. Bitget won't say how much fresh capital went in to top the fund back up.

Let me break this down. A $388 million draw against a fund that was sitting somewhere above $300 million before the incident is a real dent. Getting back above that $300 million line means somebody moved assets or wired money. How much? No figure. That's the first number I'd want, and it's missing. Frankly, that gap does more work than the announcement does.

What the $388 million actually bought

Here's what matters: Bitget says customer balances stayed accurate and unaffected. That's the claim, and the 131% reserve report is the closest thing to evidence supporting it. Reserves back account balances. The Protection Fund sits on top as a separate safeguard.

The two pools aren't interchangeable. If reserves are the deposit insurance, the fund is the catastrophe buffer.

And the catastrophe buffer took $388 million of damage. That's more than the $300 million floor the exchange promised to hold. Which tells you one of two things. Either the fund was well above $300 million before the breach, or the replenishment isn't a full restoration. Bitget isn't clarifying which. I'd bet on the first, but I shouldn't have to bet.

Now the claims side, because this is where retail users get tripped up. Under Bitget's published fund conditions, you can submit a claim when accounts are compromised or assets are stolen or lost through platform-wide events that aren't attributable to your own actions or trading behavior. Reasonable language on its face.

Read the next part. Bitget retains the right to assess claims and investigate affected accounts. Outcomes are subject to its findings. Eligibility to file doesn't guarantee reimbursement.

So what does a $300 million floor actually buy a user when the payout decision rests with the exchange? That's not a rhetorical jab. It's the structural question every customer should be asking before they decide to keep trading there.

And one more thing on the reserve number. A 2023 advisory from the PCAOB's Office of the Investor Advocate made the point plainly. Proof-of-reserves reports aren't audits. They may omit liabilities or borrowed assets. They can't assure that assets stay available afterward. That was three years ago and nothing about the format has changed.

The numbers tell the story, and the story is a snapshot taken at a single moment on Sept. 29. A 131% ratio is a good number. It's not a guarantee, and anyone treating it as one is misreading what they're looking at.

Bitget's fund page adds another wrinkle. The displayed valuation uses prices at midnight UTC each day. So the "above $300 million" figure is a daily mark, not a live balance. Between marks, the fund moves with the market.

The Oct. 2 test

Everything above is a balance-sheet conversation. The operational conversation is different, and it has a timestamp.

Oct. 2 at 08:00 UTC. That's when Bitget's incident timetable targets the remaining cryptocurrencies, fiat, and peer-to-peer services for reopening. USDT on four networks is already live. The rest isn't.

That's the number that matters most for anyone with funds stuck on the platform. A restored fund doesn't move a single coin. Withdrawal rails do.

From a risk perspective, I'd watch three things from here.

First, whether Oct. 2 holds. If that date slips, the fast fund replenishment stops looking like operational competence and starts looking like a PR move running ahead of the actual recovery.

Second, whether Bitget ever publishes claim outcomes. How many were filed, how many were paid, what the average payout looked like. No exchange does this voluntarily. The one that does would own a real differentiator.

Third, the daily fund valuation. Watch it over the next few weeks. If it drifts back toward $300 million, the cushion is thinner than the headline suggests.

What the street is missing is that this incident is a live stress test for the entire discretionary-fund model. Bitget moved fast. That deserves credit. Meeting a self-imposed deadline two days early is a genuine statement about how much cash and liquid assets the exchange can mobilize on short notice.

But speed and transparency aren't the same thing. The undisclosed replenishment figure, the snapshot-only reserve proof, the exchange-controlled claims assessment, those are the soft spots. They were soft before Sept. 24 and they're still soft now.

The exchange bought itself credibility with a deadline. Oct. 2 is where it spends it.