# Bitget Refills $300 Million Protection Fund After $387.5 Million Breach as September Sets 2026's Worst Loss Total

Two incidents, Bitget and the Liquid Network, accounted for roughly 92 percent of the month's $768 million in reported losses, and neither started with a smart-contract bug.

- Published: 2026-10-02T06:09:12.150Z
- Canonical: https://polylog.news/crypto/2026-10-02/bitget-refills-300-million-protection-fund-after-387-5-milli
- Publisher: Polylog (Crypto desk)
- Section: crypto
- Sources: [CryptoSlate](https://cryptoslate.com/bitget-restores-300m-fund-after-absorbing-388m-security-breach/), [CryptoSlate (2026 losses)](https://cryptoslate.com/crypto-hackers-have-taken-2-7-billion-in-2026-and-the-losses-are-alarmingly-concentrated/), [Rekt News](https://www.rekt.news/), [Polylog editors](https://polylog.news), [BleepingComputer](https://www.bleepingcomputer.com/news/security/bitget-hacked-via-zero-day-in-third-party-security-products/)

Bitget has [restored its $300 million protection fund](https://cryptoslate.com/bitget-restores-300m-fund-after-absorbing-388m-security-breach/) after absorbing the $387.5 million loss it suffered in late September, and is reopening withdrawals in phases. The exchange says the fund sits separate from customer reserves, and that claims remain subject to its own assessment.

The attack did not begin on-chain. Researchers describe a [zero-day exploit against two third-party security appliances](https://www.bleepingcomputer.com/news/security/bitget-hacked-via-zero-day-in-third-party-security-products/) in Bitget's own infrastructure, where the intruder obtained privileged access, installed a web shell and opened a command-and-control channel before draining hot and warm wallets across seven networks in a window of about three hours. Earliest malicious activity has been dated to 31 August. Bitget chief executive Gracy Chen has said cold wallets and private keys were never compromised. CoinDesk reported that roughly $83 million of stolen XRP was moved into a form Ripple cannot freeze.

September's aggregate numbers follow from that single event plus one more. French-language crypto channel Goku Crypto News put the month at [about $768 million lost across 30 days, with two attacks above 90 percent of the damage](https://t.me/GokuCryptoNews/20825). Security firms differ at the margin, with CertiK counting 97 incidents and about $768.4 million and PeckShield counting 55 incidents and $766.5 million. The second large loss was the Liquid Network, a Bitcoin sidechain, at roughly $320 million, of which more than $270 million was later returned. Rekt News has logged both [Bitget and Liquid Network](https://www.rekt.news/) among its incident write-ups.

For the year, CryptoSlate reports [nearly $2.7 billion in losses across 658 incidents](https://cryptoslate.com/crypto-hackers-have-taken-2-7-billion-in-2026-and-the-losses-are-alarmingly-concentrated/) through September on CertiK's count, with about $420.4 million frozen or returned and North Korea-linked thefts above $1 billion.

## What this means

The exposure sits with centralized exchange depositors and with the vendors selling security appliances, because the failure path ran through privileged operational infrastructure rather than contract code that an audit or bug bounty would cover. Bitget wants to convert a solvency question into an operational one, and a refilled $300 million backstop plus phased withdrawals is the cheapest way to do that, though a discretionary claims process keeps the residual risk with users. The precedent is the February 2025 Bybit theft, where an exchange with ample reserves survived a nine-figure loss and kept operating while the industry's loss total for the year was permanently reset upward. The likelier outcome over the next two quarters is more of the same shape: a small number of infrastructure and key-handling compromises, not contract exploits, driving the bulk of reported losses, which strengthens the case for exchanges publishing third-party infrastructure audits. That read weakens if the next large incident traces back to an on-chain logic bug in a major protocol.

## What to watch

- Whether Bitget publishes which vendor appliances were exploited, since other exchanges and custodians almost certainly run the same products.
- How much of the stolen Bitget funds move through exchanges that cooperate on freezes, the practical measure of whether attribution translates into recovery.
- Whether Bitget's planned public listing timetable changes, which would show how debt and equity markets price exchange operational risk.