Bitget Hack: CEO Gracy Chen Vows Customers Won’t Lose a Cent
Set Trending Topics as a preferred source on Google.
North Korea may have walked off with hundreds of millions from Bitget, but the exchange’s customers are not supposed to pay a single cent for it. That is the promise from Bitget CEO Gracy Chen following the massive hack on the crypto exchange, in which around $352 million (roughly €300 million) was drained from the company’s wallets on Thursday evening.
In an update on X, Chen has now laid out Bitget’s financial position to reassure users. Beyond the Protection Fund of more than $464 million (around €395 million), held entirely in publicly verifiable wallets, Bitget says it holds over $1 billion (roughly €850 million) in its own assets. “User funds are covered on a 1:1 basis,” Chen wrote.
Protection Fund Alone Exceeds the Loss
Chen’s math is simple: the Protection Fund on its own is about $110 million larger than the stolen amount. The additional billion in company assets is meant to act as a further buffer in case withdrawals surge once they reopen. According to CoinDesk, Chen also stressed that user balances are accurate. Her message to the community: “Your assets are protected.”
Bitget says only parts of its hot and warm wallets were affected. The cold wallets, where the bulk of holdings is stored, remain fully secure. Deposits and trading continue, while withdrawals remain suspended for a security review. No timeline for resuming them has been given yet.
Forged Transfers Instead of Stolen Keys
How the attack unfolded is notable as well. According to Chen, the attackers did not obtain any private keys. Instead, they gained access to the backend wallet system and forged transfer requests there. These then passed through the exchange’s regular approval processes, much like forged payment slips signed off by a company’s own accounting department. According to Investinglive, the largest share of the loot was XRP worth around $157 million, followed by Ether worth nearly $86 million.
Bitget suspects the notorious North Korean Lazarus Group is behind the attack. Some of the IP addresses used in the breach match VPN patterns associated with North Korean hackers, Chen told CNBC. The attribution has not been confirmed, however, and no technical evidence has been published so far. Chen described the possibility of employee involvement as “quite low,” though it has not been fully ruled out. A detailed incident report has been announced.
Bybit as a Blueprint
Chen herself points to the case of Bybit. The rival exchange suffered the largest hack in crypto history in February 2025, when the Lazarus Group stole Ether worth around $1.5 billion. Bybit covered the loss with its own funds and bridge loans from the industry and came through the hack surprisingly well. From the very start, Bybit communicated openly, and with the support of friendly crypto companies, it prevented any losses for its customers. Other major exchanges such as Binance and OKX also maintain similar protection funds (Binance calls its fund SAFU) to compensate customers in an emergency.
The real test for Bitget, however, will come when withdrawals are switched back on. That is when it will become clear whether users’ trust holds. The case is also relevant for Europe: Bitget has set up its European headquarters in Vienna. So far, markets have stayed calm. Bitget’s native BGB token briefly dropped after news of the hack broke but quickly recovered and was last trading down nearly 3 percent.
