Bitget's CEO doubts the $387.5 million lost through a vendor-linked backend will come back
Bitget CEO Gracy Chen doubts much of the $387.5 million stolen via a backend tied to a third-party security vendor will come back. So far about 0.2% of the loss has been frozen, so the exchange itself is paying for an outsourced security flaw.
The Investor · Invest desk
What happened
- Attackers used spoofed transaction data to push 19 transfers past Bitget's authorization checks and drain its hot and warm wallets. Cold wallets and private keys were untouched.
- Bitget first put the loss at $351.6 million, then raised it to $387.5 million after a fuller count of on-chain transfers.
- Bitget's User Protection Fund, which held over $464 million before the breach, absorbed the whole loss, and customer balances stayed intact.
- Chen compared the case to Bybit's February 2025 hack, where recovery efforts produced limited results.
Why it matters
- What it costs cost To keep its pledge of refilling the fund past $300 million within a week, Bitget has to find about $223.5 million, and neither report says where that money will come from.
- What it limits constraint Until the refill lands, the roughly $76.5 million left in the fund would cover less than a quarter of a loss the size of September's $320 million Liquid Network exploit.
- Who's exposed exposure Crypto Briefing says exchanges routinely hand security, wallet and monitoring tools to outside vendors whose vetting varies widely, so any of them can lose hot-wallet funds even when keys and cold storage stay safe.
Next story · Invest · Oct 3
Issuers and protocols have frozen about 0.2% of the $387 million taken from BitgetConfirmed3 publishers
A fund holding a little over $464 million paid a $387.5 million bill [7][1], so one breach used about 83.5% of it [12]. Bitget has promised to take the fund back above $300 million within a week [8]. That target is about $164 million below the balance before the breach [19], so even if Bitget hits the deadline, its fund will be smaller than before the attack. Its reserve ratio stayed above 100% throughout, according to Crypto Briefing [9].
The recoveries so far are small next to those sums. Tether and Circle blacklisted a wallet linked to the exploit and froze $318,013 in USDT and USDC, Chen confirmed [18]. NEAR Intents froze about $500,000 [16]. Together that is $818,013, or about 0.21% of the loss [14][15]. NEAR Intents also reported blocking more than $50 million in assets tied to the attack [16], about 12.9% of the total [21], though the reports do not say how much of the blocked sum can be returned.
The bounty has two separate 5% rewards, one for freezing stolen assets and one for recovering them [10]. If every dollar came back through the program, the two rewards together would cost Bitget $38.75 million, a tenth of the loss [23]. Cointelegraph's headline quoted Chen as "not very optimistic" about recovery [4].
If recovery stays near today's fraction, Bitget absorbs close to the full $387.5 million [1][15]. Crypto Briefing wrote that the Bybit case "demonstrated how little exchanges can realistically claw back" once attackers have moved stolen assets on-chain [28]. If NEAR's blocked $50 million became frozen money, the loss would still be about $337.5 million [22].
A finding that an insider was involved would move the blame away from the vendor. Chen said North Korea may have been responsible, pointing to IP addresses that she said matched the VPN choices of a particular North Korean group [26], and Crypto Briefing reported that attribution is still under investigation [27]. Cointelegraph wrote that she had not "totally ruled out" an inside job [24]. She also told the outlet, "It's more based on our preliminary results of the investigation, we have ruled out that possibility." [25]
I'd expect most of the money to stay lost. The strongest evidence for that is that the chief executive is lowering expectations herself [2]. The case against is that the tracing is only days old: NEAR Intents reported its block on the Monday after the breach [16]. The view is wrong if frozen balances climb from under $1 million toward the $50 million NEAR has blocked, or if the fund is not back above $300 million within the week Bitget promised [16][8].
What to watch
- Whether Bitget's User Protection Fund is back above $300 million by the one-week deadline, and whether the company says what paid for the top-up.
- Whether any of the more than $50 million NEAR Intents says it blocked is frozen or returned to Bitget.
- Whether investigators confirm the North Korea link or reopen the inside-job question, and whether the vendor is named.
Information, not investment advice. This story is general information about companies and markets, drawn from cited reporting. It is not a recommendation to buy, sell or hold any security; check the cited sources before acting.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence68
- Adoption
- Not scored
- Hype gap+5
- Incentives55
- Confidence70
Perspective Coverage
4 publishers- Builder
- Builder 25%
- Operator
- Operator 41%
- Investor
- Investor 34%
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Bitget lost $387.5 million in a security breach on September 24.
- [2]
Chen drew a direct comparison to the February 2025 Bybit hack, where recovery efforts produced underwhelming results, and signaled that the exchange is preparing for the possibility that most of the funds are gone for good.
- [3]
The initial loss estimate was $351.6 million, later revised upward to $387.5 million after more thorough on-chain accounting.
- [4]
Cointelegraph's headline quoted Chen as 'not very optimistic' on recovering funds from the breach.
- [5]
Attackers executed 19 transactions across multiple blockchain networks, draining Bitget's hot and warm wallets by exploiting a vulnerability in a backend system tied to a third-party security vendor.
- [6]
Spoofed transaction data was used to circumvent the exchange's authorization processes; cold wallets were not compromised and no private keys were exposed.
- [7]
Bitget's User Protection Fund absorbed the full loss; it held over $464 million before the breach, and customer account balances remained intact.
- [8]
Bitget committed to replenishing its User Protection Fund to over $300 million within a week of the incident.
- [9]
The exchange's overall reserve ratio stayed above 100% despite the hack.
- [10]
Bitget's bounty program offers a 5% reward for freezing stolen assets and another 5% for recovering them.
- [11]
After covering the loss, Bitget's User Protection Fund held roughly $76.5 million.
- [12]
The breach consumed about 83.5% of the pre-breach fund.
- [13]
Refilling the fund to $300 million requires a top-up of about $223.5 million.
- [14]
Assets frozen so far by NEAR Intents, Tether and Circle total about $818,013.
- [15]
Frozen assets equal about 0.21% of the $387.5 million loss.
- [16]
The team behind NEAR Intents reported on Monday that it had blocked more than $50 million in assets tied to the attack and froze about $500,000.
- [17]
The roughly $76.5 million left in the fund is about 23.9% of the $320 million Liquid Network exploit.
- [18]
Chen confirmed that stablecoin issuers Tether and Circle blacklisted a wallet linked to the exploit, freezing $318,013 in USDT and USDC.
- [19]
The $300 million refill target is about $164 million below the fund's pre-breach balance.
- [20]
The Bitget breach followed a $320 million exploit of the Liquid Network in September.
- [21]
The more than $50 million NEAR Intents blocked is about 12.9% of the loss.
- [22]
If the $50 million blocked were fully recovered, about $337.5 million would still be lost.
- [23]
If the whole loss were frozen and recovered through the bounty, the two 5% rewards would cost $38.75 million.
- [24]
Cointelegraph reported that Chen added Bitget hadn't 'totally ruled out' the possibility of an inside job.
- [25]
"It's more based on our preliminary results of the investigation, we have ruled out that possibility."
- [26]
Chen said North Korea may have been responsible, based on "IP addresses that match the VPN choices by a certain [Democratic People's Republic of Korea] group."
- [27]
Investigators have flagged suspicious activities potentially linked to North Korean entities; precise attribution remains under investigation.
- [28]
Crypto Briefing wrote that the Bybit incident 'demonstrated how little exchanges can realistically claw back' once sophisticated attackers have moved stolen assets on-chain.
- [29]
Exchanges routinely outsource security components, wallet infrastructure and monitoring tools to specialized vendors, and the vetting processes for these vendors vary widely across the industry.
Sources
3 independent publishers whose own reporting we read for this story.
- cnbc.comBitget `not expecting to recover a lot' from $388 million hack, CEO tells CNBC
1 article · October 1, 2026
- cointelegraph.comBitget CEO ‘not very optimistic’ on recovering funds from $388M breach
1 article · September 29, 2026
- cryptobriefing.comBitget CEO Gracy Chen expresses skepticism on recovering $387.5M in stolen funds
1 article · September 29, 2026
- qz.comBitget has frozen just $1.1 million of $388 million stolen in crypto hack
1 article · October 2, 2026