Bitget, the Seychelles-based cryptocurrency exchange, said on Wednesday, September 30, 2026, that its User Protection Fund has been restored to above $300 million, meeting a pledge it made after attackers moved about $387.5 million from its hot and warm wallets on September 24.
Chief Executive Officer (CEO) Gracy Chen also confirmed that peer-to-peer (P2P) withdrawals will open at 08:00 Coordinated Universal Time (UTC), or 13:30 Indian Standard Time (IST), on Friday, October 2, alongside every other asset still frozen.
In a post on X, Chen shared a screenshot of Bitget’s public fund page showing a balance of $309 million, including 3,705 Bitcoin (BTC). She said withdrawals of BTC, Ether (ETH), and Tether (USDT) are already running and that “P2P withdrawal starts on Friday UTC 8am, together with everything else.”
Fund Rebuilt Two Days After Refill Pledge
The User Protection Fund is a reserve pool Bitget set up in 2022 with a $300 million commitment. It is held in publicly listed wallets and is meant to cover platform-level losses such as hacks. It is separate from the reserves that back customer balances.
When the breach was disclosed, Bitget said the fund held 5,500 BTC, worth about $464 million at the time, and that it would absorb the loss. Covering the theft pushed the fund below $200 million, based on the three wallet addresses Bitget cites for it, Bloomberg reported. On September 28, Chen pledged to top the fund back up to more than $300 million with company capital within the week.
The fund now holds 1,795 fewer BTC than before the breach. Because its value is tied largely to the Bitcoin price, the $309 million figure is a point-in-time reading. At that snapshot, the margin above the $300 million floor was about $9 million, or roughly 3%.
Proof of Reserves Is a Separate Measure
A Proof of Reserves (PoR) report shows the crypto assets an exchange holds against the balances it owes customers. Bitget’s version uses a Merkle tree, a cryptographic structure that lets users independently verify their balances were included without exposing other accounts.
Bitget’s 47th PoR report, based on a snapshot at 09:00 UTC on September 29, put the overall reserve ratio at 131% across 19 assets. Coverage stood at 142% for BTC, 110% for ETH, 107% for USDT, and 154% for USD Coin (USDC). The previous issue, published earlier in September, reported a total ratio of 135%.
The two figures answer different questions. The PoR ratio measures whether customer liabilities are covered. The Protection Fund is an additional buffer for losses the platform itself absorbs.
Outflows Remain the Pressure Point
Bitget recorded about $463 million in net outflows in the 24 hours leading up to Tuesday, September 29, the largest one-day net outflow since data aggregator DeFiLlama began tracking exchange reserves about four years ago, according to Bloomberg. The same report said the outflow equaled more than 10% of Bitget’s reserves.
Flows on individual assets have varied. In the first hour after ETH withdrawals reopened, Bitget reported a net inflow of 651 ETH.
Bitget Withdrawal Schedule
Bitget published its phased timetable on its Support Center on September 26. Trading and deposits continued throughout.
| Date (UTC 08:00 / IST 13:30) | Assets | Networks | Status |
|---|---|---|---|
| September 28 | BTC | Bitcoin | Live |
| September 29 | ETH | Ethereum, BNB Smart Chain (BSC), Arbitrum, Base, Optimism | Live |
| September 30 | USDT | Ethereum, BSC, Solana, Tron | Live |
| October 2 | Other tokens, fiat, P2P | All remaining | Scheduled |
P2P trading lets users buy and sell crypto directly with other users for local currency, usually through bank transfers or payment apps, with the exchange holding the crypto in escrow. Fiat withdrawals move government-issued currency such as dollars or euros out of the platform. Bitget has said the staggered order is a security step and not related to the availability of user assets.
What Has Not Changed
Chen has said the attacker exploited vulnerabilities in third-party products to steal internal credentials, then used them to send fraudulent withdrawal commands. She said private keys were not compromised and cold wallets were not affected. Google-owned Mandiant and blockchain security firm SlowMist continue to support the forensic investigation.
Bitget raised its loss estimate from $351.6 million to about $387.5 million on September 25 after tracing additional transactions. Chen earlier pointed to preliminary signs of North Korean involvement, but no government agency has made a public attribution.
What to Watch
Two questions remain open for users: whether Friday’s final phase opens on time, and whether the Protection Fund stays above $300 million as more assets leave the platform and the bitcoin price moves. Bitget has also said it expects to publish an official security report on the incident.
Also Read: Bitget $387.5M Hack: SlowMist and Mandiant Say Zero-Day Attack Began Weeks Before Theft
