Bitget Says Protection Fund Recovery Reaches $309M, “Near Normal”

Bitget says it has moved back toward normal operations after a security breach that led to the loss of $388 million in user funds. In a post on X, Bitget CEO Gracy Chen said withdrawals for all tokens would resume on Friday, and that the exchange has already restored access for users to Bitcoin (BTC), Ether (ETH), and USDt (USDT).

As part of its recovery efforts, the exchange also reported that its in-house Protection Fund reached $309 million. The fund was designed to support users in situations where losses arise from incidents on the platform side—an important detail for users watching how exchanges manage security events beyond promises to “restore balances.”

Key takeaways

• Bitget plans to restart withdrawals for all tokens on Friday, following partial restoration for BTC, ETH, and USDT.
• The Protection Fund reportedly rose to $309 million to absorb the financial impact of the breach.
• Bitget says it has not ruled out potential responsible parties, including the possibility of an inside job or North Korean-linked activity.
• Investigators reported movements of stolen funds, including Zcash transfers linked to the incident.

What Bitget says is changing for users

Bitget’s latest update is aimed directly at usability and access. According to Chen’s X announcement, withdrawals for all tokens would resume on Friday, after the exchange had already restored withdrawals or access to major assets including BTC, ETH, and USDT.

For traders and businesses that rely on exchange liquidity, the difference between partial access and full withdrawal restoration can be significant. It affects everything from hedging to the ability to move funds quickly after volatile market moves—so Bitget’s “all tokens” timeframe is likely to be a key signal for the platform’s operational recovery.

The Protection Fund and how it was built

Bitget’s response also hinges on its “Protection Fund,” which Chen said has reached $309 million. The company originally established the fund in January 2022 with 5,500 BTC, with the intent of reimbursing users for potential losses that are “not a result of any misconduct from the user or the platform itself.”

Bitget frames the fund as a rapid-response buffer: funds were described as being available for “instant deployment whenever the need arises.” That matters because incidents involving centralized exchanges often create a timing gap between when funds are frozen and when users can access replacement balances or withdrawals.

Chen told Cointelegraph that the Protection Fund “was created for moments like this and absorbed the financial impact of the incident,” reinforcing the company’s position that its recovery mechanism was intended for exactly this type of event.

Open questions about responsibility and the bounty program

While Bitget is restoring access, it has not closed the investigation. In comments to Cointelegraph, Chen said the exchange still had not ruled out certain parties that could have been involved in the attack. She pointed to possibilities including an inside job or North Korean hackers, indicating Bitget believes the incident could have involved more than a purely external breach.

Following the hack, Bitget also launched a bounty program. The program offered 5% of the frozen funds and 5% for any recovered funds, a structure that ties incentives to both the ability to locate assets and the success of bringing stolen crypto back into custody.

For investors, the key issue is that while the exchange’s operational status improves, accountability and attribution remain unresolved. The faster an incident can be tied to specific actors and tactics, the more likely it becomes that industry defenses—such as monitoring, authentication controls, and threat intelligence—can adjust effectively for future risks.

Investigator updates show attackers may still be moving funds

Alongside Bitget’s internal recovery messaging, outside analysts have continued monitoring on-chain activity. ZachXBT, a blockchain investigator, reported on Wednesday that wallets linked to the Bitget hack moved roughly $3.8 million in Zcash (ZEC) into the network’s Ironwood pool.

According to ZachXBT, the transactions corresponded to about 14% of the 18,917 ZEC stolen during the attack. Moving funds into anonymity-related systems like pools can complicate tracing and recovery—so these updates can influence how quickly exchanges and investigators anticipate they might regain control over stolen assets.

While Bitget has emphasized its internal fund deployment and partial restoration already underway, investigator activity suggests the operational and investigative work will continue in parallel.

Going forward, readers should watch whether Bitget’s Friday withdrawal schedule holds for all token pairs and whether additional on-chain intelligence leads to further recovery announcements under its bounty program. The next phase will likely be a blend of operational verification for users and continued clarity on attribution for the broader security picture.