Bitget Protection Fund Tops $309M as Recovery “Normalizes”

Bitget CEO Gracy Chen says the crypto exchange is working back toward normal operations after a security breach that led to the loss of $388 million in user funds. In an X post on Wednesday, Chen stated that withdrawals for all tokens would resume on Friday, adding that Bitget has already restored access for users to Bitcoin (BTC), Ether (ETH), and USDt (USDT).

As the exchange moves through recovery, Bitget has also pointed to the balance of its internal “Protection Fund,” which, according to Chen, has reached $309 million after absorbing the financial impact of the incident.

Key takeaways

• Bitget plans to resume withdrawals for all tokens on Friday, after already restoring BTC, ETH, and USDT access.
• The exchange’s Protection Fund is reported at $309 million and was designed to cover losses tied to security events.
• Bitget’s CEO said the exchange has not ruled out potential responsible parties, including the possibility of an insider or North Korean-linked attackers.
• Blockchain investigator ZachXBT reported that a portion of stolen funds was later moved into Zcash (ZEC) liquidity infrastructure, representing about 14% of the stolen ZEC.

Withdrawals return as Bitget continues recovery

Bitget’s operational restoration is centered on user fund access. Chen’s Wednesday message indicated that withdrawals across all tokens would resume on Friday, following steps already taken to reconnect users with major assets.

While exchanges often face extended downtime after incidents that trigger suspensions or freezes, Bitget’s stated timeline suggests the company is attempting to unwind restrictions quickly while recovery efforts continue in the background. For users and market participants, that matters because partial resumption (already for BTC, ETH, and USDT) reduces uncertainty around where funds stand and what liquidity will be available through the exchange.

Protection Fund reaches $309 million

In parallel with operational updates, Bitget emphasized its Protection Fund, which is intended to reimburse users for potential losses that are not attributed to user misconduct. The fund was initially established in January 2022, according to Bitget’s own description, with 5,500 BTC, and was structured so that capital would be “available for instant deployment whenever the need arises.”

Chen told Cointelegraph that the fund was created specifically for incidents like this and that it “absorbed the financial impact of the incident.” Bitget also described the Protection Fund as a mechanism to help cover losses resulting from events beyond the direct control of users.

Investors and traders typically watch how exchanges handle these funds because it can shape perceptions of counterparty risk. If the Protection Fund can be deployed promptly, it may reduce the chance that users are forced to wait longer for compensation or that the exchange’s solvency is questioned.

What Bitget still says about the attackers

Although Bitget has characterized recovery steps and reimbursement capacity, Chen said the company has not finalized conclusions about who carried out the $388 million attack.

In comments provided to Cointelegraph, Chen indicated Bitget still had not “ruled out certain parties,” mentioning scenarios ranging from an inside job to North Korean hackers. In addition to its response posture, Bitget launched a bounty program linked to the incident. Per Chen, the program offered 5% of the frozen funds to parties providing actionable information, and an additional 5% for recovered funds.

The practical significance of this approach is twofold. First, it keeps investigative openness while recovery is underway. Second, a bounty can incentivize external parties who monitor on-chain movements to participate more actively in tracing and recovering assets—especially when stolen funds are split across multiple wallets and conversion routes.

On-chain activity after the breach: ZEC moved to Ironwood

Further insight into the incident’s aftermath came from ZachXBT, a blockchain investigator who reported on Wednesday that wallets linked to the Bitget hack moved about $3.8 million in Zcash (ZEC) into the network’s Ironwood pool.

ZachXBT’s report described the transactions as roughly 14% of the 18,917 ZEC stolen in the attack. The detail matters because it signals continued attempts to route stolen assets into liquidity mechanisms, which can complicate tracking and recovery, even after an exchange starts working to restore services.

Move-to-pool behavior is often associated with efforts to improve liquidity access, potentially making it harder for defenders to unwind movements without additional coordination. At the same time, blockchain investigators and tracing services can use such on-chain markers—like pool interactions—to refine their understanding of where funds may flow next.

Earlier coverage from Cointelegraph noted that NEAR Intents said it blocked $50 million tied to the Bitget hackers. That development is separate from ZachXBT’s ZEC-specific reporting, but together they reflect a broader pattern seen in major incidents: stolen funds may be contested across different networks and infrastructure layers as investigators track, freeze, or obstruct portions of the flow.

What to watch next

With withdrawals set to resume for all tokens on Friday, the most immediate question for Bitget users will be how quickly remaining access restrictions are fully removed and whether the exchange’s Protection Fund deployment translates into concrete user outcomes. Longer term, Bitget’s ability to narrow down attribution—and the on-chain trail of any remaining stolen assets—will likely determine how effective bounty incentives and recovery efforts prove in practice.