Bitget CEO says he’s not optimistic about recovering $388M breach losses

Bitget’s CEO has cast doubt on whether the exchange will be able to fully freeze or recover the crypto assets stolen in last week’s security breach, after the company updated the total losses to about $388 million.

In an interview with Cointelegraph’s Chain Reaction released Tuesday, Bitget CEO Gracy Chen drew on Bybit’s February 2025 hack as a reference point—arguing that even after a year, only a small fraction of the stolen funds had been frozen.

Key takeaways

• Bitget CEO Gracy Chen says she is “not very optimistic” about fully freezing or recovering the assets stolen in Bitget’s breach.
• Chen cited Bybit’s February 2025 ETH theft, where Bybit froze and recovered about $80 million out of roughly $1.5 billion, which she described as only ~3.5% frozen.
• Bitget’s response includes a bounty program paying 5% for funds frozen and 5% for funds recovered.
• Other actors report mitigation steps: NEAR Intents says it blocked $50+ million and froze about $500,000; Chen also said Tether and Circle blacklisted a wallet linked to the exploit.
• Bitget has resumed withdrawals in stages—beginning with BTC on Monday and ETH on Tuesday—after an earlier pause tied to the incident.

Why Bitget’s recovery plan faces an uphill battle

Chen’s central message was about limits—specifically, how long it can take to identify stolen assets and whether exchange-level controls can actually stop them from moving.

She pointed to the Bybit breach from February 2025, when hackers stole about $1.5 billion worth of Ether (ETH). According to Chen, Bybit reported freezing and recovering only about $80 million in total. She framed that outcome as a cautionary example: “after a year or so of Bybit’s hack, they’ve only [been able to freeze] about 3.5% of the total stolen funds,” noting that the figure reflects freezing, not full recovery.

The implication for Bitget users is stark. Even with active incident response, asset tracking, and coordination with ecosystem partners, freezing and recovery are not guaranteed—particularly once funds are routed through multiple wallets or moved beyond the reach of exchange controls.

Bitget’s incident response: bounties and staged withdrawals

Following the breach, Bitget rolled out a bounty program intended to accelerate mitigation efforts. The program offers 5% of frozen funds and an additional 5% for recovered assets, according to the interview coverage.

At the same time, Bitget started reopening access for affected users. Chen said withdrawals resumed in stages: BTC withdrawals began on Monday, followed by ETH withdrawals on Tuesday.

Bitget had initially reported a loss of $352 million after the Thursday attack and later updated its accounting. Chen explained that the company’s revised figure reflects a “more complete accounting of transfers,” bringing the total reported loss to about $388 million.

External mitigations: NEAR Intents and stablecoin blacklists

Bitget’s problem is not only internal risk management—it also depends on whether infrastructure providers can block, freeze, or otherwise constrain the stolen assets.

Chen highlighted steps taken by third parties in response to the hack. The team behind NEAR Intents said earlier this week that it had blocked more than $50 million in assets tied to the incident and froze about $500,000.

In addition, Chen confirmed that stablecoin issuers Tether and Circle blacklisted a wallet linked to the exploit. She said this resulted in $318,013 being frozen in USDt (USDT) and USDC (USDC).

These actions matter because stablecoin routing and liquidity often determine whether stolen funds can be converted quickly, moved across venues, or used for downstream transactions. Blacklists and intent-layer controls can slow that process, though they do not necessarily address every chain path or counterpart.

How serious is the breach within 2026’s broader hack cycle?

According to Cointelegraph reporting cited in the original coverage, the Bitget breach is among the largest security incidents impacting the crypto industry in 2026. The comparison set includes high-profile exploits that also left recovery incomplete for extended periods.

The referenced context includes a $320 million exploit of the Liquid Network in September, as well as earlier industry-defining hacks such as the 2025 Bybit incident, the $615 million Ronin Bridge hack in 2022, and the $611 million Poly Network hack in 2021.

While each breach differs in technical details, the pattern is consistent: large thefts often trigger a multi-layer response involving exchanges, protocol tooling, compliance mechanisms, and ecosystem partners. Chen’s emphasis on Bybit’s slow and limited frozen share reinforces the idea that even mature teams face structural constraints once funds are dispersed.

Attribution remains under investigation

Chen also discussed who may be behind the attack. She said Bitget suspected North Korea immediately after the incident, citing “IP addresses that match the VPN choices by a certain [Democratic People’s Republic of Korea] group,” while also stressing that Bitget had not fully excluded other possibilities.

She described attribution as complex and dependent on deeper investigation, saying the company had ruled out the inside-job possibility based on preliminary results, but that the matter still required thorough follow-up.

For Bitget users, the next key developments are whether additional wallets will be blocked, how much of the stolen crypto can be frozen over time, and whether the exchange’s staged reopening continues without further issues—particularly as investigators narrow the scope of the transfers and the industry monitors whether mitigation efforts can scale beyond early checkpoints.