The drawdown came as customers pulled a record $463 million, net, in a day after withdrawals reopened. The CEO says she is "not very optimistic" about recovering the $388 million stolen last week.
A week ago, Bitget pointed customers to a $464 million user protection fund as proof their money was safe. By Tuesday, the three wallets the exchange names as the fund's source held less than $200 million.
That means more than $264 million, or about 57% of the fund, has been spent. "The Protection Fund is being used to absorb the financial impact of the incident," Chief Executive Gracy Chen said. "Bitget will replenish the Fund using its own capital, with the Fund targeted to be above $300 million within one week." Getting from below $200 million to above $300 million requires more than $100 million of the company's own money in seven days.
The outflow
The drawdown coincided with a rush for the exits. Net withdrawals reached about $463 million in the 24 hours into Tuesday, the largest single-day figure for any exchange in four years of proof-of-reserves tracking. Bitget still reports about $5.7 billion in reserves, so the day's outflow equaled more than 10% of them.
Withdrawals are reopening asset by asset. Bitcoin came first on Monday. Ether and tokens on BSC, Arbitrum One, Base and Optimism followed at 08:00 UTC on Tuesday. USDT is due Wednesday, with remaining assets, fiat and peer-to-peer services on Oct. 2.
Recovery odds
Chen now puts the theft at about $388 million, up from an initial $352 million after what she called a more complete accounting of transfers. Her benchmark for getting it back is Bybit's February 2025 hack. "I'm actually not very optimistic because after a year or so of Bybit's hack, they've only [been able to freeze] about 3.5% of the total stolen funds," she said. "That's only the freezing. It's not about recovery yet."
Applied to Bitget's loss, a 3.5% freeze rate would come to about $13.6 million. So far Tether and Circle have frozen $318,013 of their tokens in a wallet tied to the exploit, about 0.08% of the total. Bitget has offered a 5% bounty on funds frozen and on funds recovered.
Attribution
Elliptic, a blockchain analytics firm, attributes the attack to TraderTraitor, a group linked to North Korea, and says the theft lifts North Korea's crypto takings this year past $1 billion. Chen has pulled back from her earlier suspicion. "What I shared previously was based on preliminary indicators... those indicators are still being assessed and should not be treated as a definitive attribution," she said. No government has made a formal attribution.
The next reopening
Wednesday's USDT restart is the next test of demand to leave. The fund's wallet balances will show within a week whether Bitget adds the $100 million-plus it has promised, and daily reserve figures will show whether net outflows fade after the first rush.