Bitget CEO expects limited recovery from nearly $388 million hack

Approximately $1.1 million of the nearly $388 million stolen from Bitget in last week's cyberattack has been frozen. CEO Gracy Chen said frozen assets have not necessarily been returned to Bitget and did not disclose how much has been recovered. Chen said she does not expect to recover much, citing limited recoveries from previous cryptocurrency exchange hacks. Chen said exchanges have a responsibility to show how they protect users when something goes wrong. Bitget said customer account balances were unaffected. Bitget valued its protection fund at more than $464 million before the theft. The fund fell below $200 million after the hack, according to Bloomberg's calculation using disclosed wallet addresses. Bitget restored the fund to more than $300 million using its own capital, Chen said. Chen said the replenished fund is publicly verifiable on-chain and separate from reserves backing customer balances. Bitget's latest Proof of Reserves, based on a Sept. 29 snapshot, showed a self-reported overall reserve ratio of 131%, with all 19 covered assets backed above 100%. Chen said Bitget is absorbing the financial impact rather than passing it on to users. Investigation reports released Sept. 30 by Mandiant and SlowMist found that attackers compromised two third-party security products before accessing Bitget's production wallet systems. SlowMist traced the earliest malicious activity in available logs to Aug. 31, when attackers exploited a previously unknown vulnerability in one product. Mandiant reported that the attackers gained privileged internal access and bypassed the normal customer-facing withdrawal process without stealing private keys. Chen said the attackers deleted traces after transfers to hinder the investigation. Neither investigation report identified the affected products, and Chen declined to identify them, citing potential security risks. Neither report attributed the attack to North Korea. Chen had previously said preliminary technical indicators were highly consistent with known North Korean hacking groups and said further details were needed. Withdrawals for bitcoin, ether and USDT have resumed. Bitget has scheduled withdrawals for its remaining cryptocurrencies, along with fiat and peer-to-peer services, to resume on Friday.