Bitget Refills $300 Million Protection Fund After $387.5 Million Breach as September Sets 2026's Worst Loss Total

Bitget has restored its $300 million protection fund after absorbing the $387.5 million loss it suffered in late September, and is reopening withdrawals in phases. The exchange says the fund sits separate from customer reserves, and that claims remain subject to its own assessment.

The attack did not begin on-chain. Researchers describe a zero-day exploit against two third-party security appliances in Bitget's own infrastructure, where the intruder obtained privileged access, installed a web shell and opened a command-and-control channel before draining hot and warm wallets across seven networks in a window of about three hours. Earliest malicious activity has been dated to 31 August. Bitget chief executive Gracy Chen has said cold wallets and private keys were never compromised. CoinDesk reported that roughly $83 million of stolen XRP was moved into a form Ripple cannot freeze.

September's aggregate numbers follow from that single event plus one more. French-language crypto channel Goku Crypto News put the month at about $768 million lost across 30 days, with two attacks above 90 percent of the damage. Security firms differ at the margin, with CertiK counting 97 incidents and about $768.4 million and PeckShield counting 55 incidents and $766.5 million. The second large loss was the Liquid Network, a Bitcoin sidechain, at roughly $320 million, of which more than $270 million was later returned. Rekt News has logged both Bitget and Liquid Network among its incident write-ups.

For the year, CryptoSlate reports nearly $2.7 billion in losses across 658 incidents through September on CertiK's count, with about $420.4 million frozen or returned and North Korea-linked thefts above $1 billion.