Bitget faces a $351.6 million loss after a breach linked to North Korean hackers. The incident could drain most of its user protection fund, raising new questions about exchange security and customer asset recovery as withdrawals remain frozen.
Bitget's user protection fund is under heavy strain after a $351.6 million hack that investigators say looks like the work of North Korean groups. The theft is so large that Bitget may have to use up to 76% of its $464 million reserve. Now, the exchange's ability to cover customer losses is in question.
Attack attribution and investigation
Bitget says the attack happened on September 24 at 18:31 UTC. Unusual transfers from some hot wallets set off emergency protocols. The exchange quickly froze withdrawals for a full security check. Deposits and trading stayed open. Bitget reported the breach to law enforcement and brought in on-chain security firms to help investigate. Early findings show only part of the hot and warm wallet layer was hit. Cold wallets stayed safe during the attack.
Bitget's estimated $351.6 million loss is fully covered by its User Protection Fund, which held over $464 million at the time of the breach.
Bitget hired blockchain security firms Mandiant and SlowMist, but outside confirmation that North Korea was behind the hack is still missing. Onchain analyst Specter linked the stolen XRP to funds from the $24 million AFX hack in July, which was blamed on the TraderTraitor cluster tied to North Korea's Lazarus Group. Bitget's own investigation is ongoing. Another report said there was no sign of a private-key leak, pointing instead to a breach in wallet infrastructure, not a full key compromise.
Asset impact and recovery efforts
The hack hit many assets, including ETH, XRP, BNB, AVAX, USDT, and USDC. It spread across networks like Ethereum, XRP Ledger, Arbitrum, Avalanche, Optimism, BNB Chain, and Base. XRP took the biggest hit on a single network. Bitget says some blockchain foundations have already frozen addresses linked to the attacker. If these freezes hold, the final loss could be smaller. The company stressed that its cold wallets and the separate Bitget Wallet self-custody product were not touched.
Protection fund under pressure
Withdrawals on Bitget are still frozen while the exchange runs a wider security review. Bitget says any losses it can't recover will be paid from its User Protection Fund, which holds 5,500 Bitcoin worth over $464 million. CEO Gracy Chen said the fund will be topped up after covering the hack, but did not say how much would come from Bitget's own assets or what the fund's balance will be after payouts. The company claims to have over $1 billion in proprietary assets and says customer funds are backed 1:1. Its last proof-of-reserves report, dated September 17, showed a 135% reserve ratio across 19 assets. But that report came before the hack and does not show the current state.
Bitget's User Protection Fund, publicly promoted as a 5,500 BTC reserve, is designed to shield users from platform-wide threats such as cybersecurity incidents. The fund's adequacy and transparency are now under heightened scrutiny following the breach.
Ongoing uncertainty for users
Bitget has not said when withdrawals will reopen. The company says access will return only after more security checks. For now, customers are stuck waiting as investigators try to recover assets and figure out how much the exchange has lost. This situation is similar to other big crypto hacks, like those reported earlier, where asset recovery is slow and complicated by the spread of funds across many blockchains.
The $351.6 million loss is one of the biggest single-exchange hacks in recent years. Bitget's User Protection Fund, with 5,500 Bitcoin (worth over $464 million at the time), is meant to cover customer losses in cases like this. The last proof-of-reserves report, from September 17, showed a 135% reserve ratio across 19 assets, but that number does not reflect the post-hack situation. The final hit to the fund will depend on how much can be frozen or recovered.
Exchange protection funds are supposed to give users a safety net if there's a hack or operational failure. But how well they work depends on the fund's size, how fast assets can be recovered, and how transparent the reporting is. In reality, users face risks when withdrawals are frozen and the reimbursement process is unclear. The Bitget case shows why it's important to know how exchanges structure their reserves, the limits of proof-of-reserves snapshots, and how hard it is to trace and freeze stolen assets across different blockchains. As crypto exchanges keep facing advanced attacks, the strength and management of user protection funds will stay in the spotlight for both companies and their customers.
