Bitget CEO Gracy Chen told CNBC that the exchange does not expect to recover a significant portion of the nearly $388 million stolen in last week’s cyberattack. Currently, approximately $1.1 million of the assets have been frozen, though Chen clarified these funds had not necessarily been returned to the platform. The attack compromised two third-party security products, allowing hackers to bypass normal withdrawal processes without stealing private keys, according to reports from Mandiant and SlowMist released on Sept. 30. SlowMist traced the initial exploitation of a zero-day vulnerability to Aug. 31.
Despite the theft, Bitget reported that user account balances remain unaffected. The exchange’s protection fund was drawn down from over $464 million to below $200 million following the incident but has since been restored to more than $300 million using company capital. A Proof of Reserves snapshot from Sept. 29 showed an overall reserve ratio of 131%, with all covered assets backed above 100%. Withdrawals for bitcoin, ether, and USDT have resumed, while remaining cryptocurrency and fiat services are scheduled to restart on Friday.
The limited recovery of stolen assets underscores the persistent challenge crypto exchanges face in mitigating financial losses from sophisticated cyberattacks. By absorbing the impact through its own capital rather than passing it to users, Bitget attempts to maintain trust, yet the reliance on third-party security infrastructure highlights a critical operational risk vector. The attackers’ ability to bypass standard protocols without compromising private keys suggests that traditional custody safeguards may be insufficient against supply chain vulnerabilities.
Regulatory scrutiny will likely intensify regarding vendor management and incident response transparency. While preliminary indicators pointed toward North Korean hacking groups, the lack of definitive attribution in official reports leaves room for continued uncertainty. Market participants should monitor how Bitget’s replenished protection fund withstands future stress tests and whether the delayed resumption of broader withdrawal services impacts liquidity perceptions among institutional clients.
