Bitget CEO Says Recovery From $388M Breach Looks Uncertain

Bitget’s CEO Gracy Chen says the exchange is not confident it will be able to fully freeze or recover the majority of assets stolen in last week’s security breach, which Bitget updated to reflect roughly $388 million in losses.

Speaking to Cointelegraph on its Chain Reaction program released Tuesday, Chen pointed to Bybit’s February 2025 hack as a cautionary benchmark—where the attacker reportedly took about $1.5 billion in Ether (ETH), but Bybit said it ultimately froze and recovered only around $80 million. In Chen’s view, that outcome translates to limited effectiveness even after extended time and effort.

Key takeaways

• Bitget’s CEO Gracy Chen says the company is “not very optimistic” about fully freezing or recovering stolen funds from the breach.
• Chen cited the February 2025 Bybit hack—reportedly $1.5 billion stolen in ETH—for comparison, noting only a small portion was frozen after about a year.
• External security responses have already reported activity linked to Bitget-related thefts, including blocking of assets and small amounts of additional freezes.
• Tether and Circle reportedly blacklisted a wallet associated with the exploit, freezing $318,013 in USDT and USDC.
• Bitget resumed withdrawals in stages, beginning with Bitcoin transactions on Monday and moving to ETH on Tuesday.

Why Bitget’s CEO is cautious about recovery

Chen’s comments centered on a core investor and user question after major exchange incidents: not just how much was stolen, but what proportion can realistically be halted before funds move irreversibly, and how much can later be recovered.

In her discussion, Chen framed Bybit’s experience as a “good reference point” for what Bitget may be able to achieve. According to Chen, Bybit’s freeze results after roughly a year amounted to about 3.5% of the stolen funds—before even considering recovery. That distinction matters because freezing deals with preventing further movement, while recovery involves locating assets that may already be in hard-to-trace custody.

For users, this means expectations may need to be calibrated: even when an exchange and partner institutions act quickly, the proportion of stolen crypto that can be stopped is often far lower than the headline theft figures suggest.

What others have done so far to limit damage

Beyond Bitget’s internal response, additional entities have reported steps aimed at constraining funds tied to the breach.

According to Cointelegraph, the team behind NEAR Intents said on Monday it had blocked more than $50 million in assets associated with the Bitget attack, and it reported freezing about $500,000. Chen also confirmed that stablecoin issuers Tether and Circle blacklisted a wallet connected to the exploit, which reportedly resulted in $318,013 being frozen in USDt (USDT) and USDC (USDC).

These actions highlight a practical reality of exchange hacks: while recovery can be slow and uncertain, the immediate ability to block specific addresses or routes can reduce downstream settlement and make stolen funds harder to convert or move through intermediaries.

Scale of the incident and how it fits a broader pattern

Bitget’s breach is being treated as one of the larger security incidents affecting the crypto industry in 2026. Cointelegraph noted that the episode follows a $320 million exploit of the Liquid Network in September.

The industry has also seen other high-profile thefts that serve as context for why freezes and recoveries are consistently difficult. Among the incidents cited by Cointelegraph are Bybit’s 2025 hack, the $615 million Ronin Bridge hack in 2022, and the $611 million Poly Network hack in 2021.

While each case differs in execution and asset movement, the pattern underscores the same challenge: once funds leave the initial custody boundary, the technical and legal pathways to recover value become more complex—especially if stolen assets are already fragmented across addresses or converted through liquidity layers.

Bitget’s investigation signals, withdrawals resume in stages

In addition to discussing recovery expectations, Chen addressed what Bitget believes about who may be behind the attack. Immediately after the breach, she said Bitget suspected North Korea could be responsible, pointing to “IP addresses that match the VPN choices by a certain [Democratic People’s Republic of Korea] group.” She also said Bitget had not fully ruled out the possibility of an inside job.

“This is a very complicated matter that we need to do a lot of investigation and quite thoroughly [sic] investigation. It’s more based on our preliminary results of the investigation, we have ruled out that possibility.”

In operational updates, Bitget began resuming withdrawals for users in stages. According to the same Cointelegraph report, the exchange restarted Bitcoin (BTC) withdrawals on Monday and continued with Ether (ETH) on Tuesday.

Separately, Bitget’s accounting of losses evolved after the initial reports. The exchange first said it had suspended withdrawals following the loss of $352 million in digital assets in Thursday’s attack, and Chen later updated the figure after what she described as a more complete accounting of transfers—placing the losses at about $388 million.

What to watch next

For users and market participants, the next signposts are whether Bitget can expand the set of addresses it can freeze early and whether partner actions—such as blacklisting and blocking—continue to reduce the usable liquidity available to attackers. Chen’s remarks suggest that full recovery is unlikely by default, so tracking incremental freezes, withdrawal resumption, and further accounting updates will be more informative than headline totals alone.