Customers pulled around $463 million out of the trading platform Bitget within 24 hours. That is the largest single-day outflow the data service DefiLlama has measured at a centralised exchan
Customers pulled around $463 million out of the trading platform Bitget within 24 hours. That is the largest single-day outflow the data service DefiLlama has measured at a centralised exchange since it started tracking reserves four years ago, and it falls exactly in the days in which Bitget is reopening the withdrawals it froze after the attack of September 24. The user protection fund meant to absorb the damage has dropped from more than $464 million to less than $200 million in the process. Bloomberg reported the figures on September 29, 2026.
For investors in Europe the episode matters for two reasons. First, the withdrawal timetable still runs until October 2, and any remaining balances on frozen accounts hang on that date. Second, the case shows where the counterparty risk of an exchange can actually be read off: in reserves, fund size and outflows, not in marketing promises.
DefiLlama follows the publicly known wallet addresses of large trading venues and nets inflows against outflows. A net outflow means more value left the exchange addresses than arrived. The $463 million are therefore not losses but customer assets that moved, mostly to private wallets and to other trading venues.
The sum only falls into place when you compare it with the size of the house. According to the same data, Bitget holds reserves of around $5.84 billion. A day with $463 million of outflows therefore amounts to just under eight percent of total reserves. A house that size can absorb it, as long as the movement does not persist for days and as long as withdrawals clear without delay.
That is exactly why the timetable is staggered. Bitget released Bitcoin first, then Ether and stablecoin withdrawals in USDT. The remaining tokens, fiat money and peer-to-peer trading follow on October 2. The company said the staggering was a security measure and had nothing to do with the availability of customer assets.
A user protection fund is a capital cushion an exchange holds voluntarily to cover damage from attacks or system failures. Bitget runs one publicly and states its level regularly. Before the incident it stood at more than $464 million, just above the damage total. Having absorbed most of the loss, it now sits below $200 million.
Chief executive Gracy Chen commented on replenishing it. The fund is being used to absorb the financial consequences of the incident, and Bitget will top it up out of its own capital, with the aim of being back above $300 million within a week. That target is a company announcement, not an audited level. Anyone who wants to follow the progress will find the current value on the protection fund page.
The damage total has grown over the course of the week. Immediately after the incident the figure discussed was $351.6 million; reports now put it at $387.5 million to $388 million. Upward revisions of that kind are the norm in forensic work, because affected addresses are only attributed one after another.
On the attack path, Bitget disclosed that the attackers got into the withdrawal systems through a previously unknown flaw in a bought-in security product. How that chain ran in detail was described by cryptoticker.io on September 29 in its own reconstruction of the attack path. Chief executive Gracy Chen said early forensic indications pointed to North Korean actors, specifically the group known as Lazarus. The security firms Mandiant and SlowMist are assisting the investigation. That is an attribution by the affected company, not a finding by any authority.
The protection fund carried most of the damage and now stands at less than half its starting value.
To put the daily figure in context, the newsroom went through DefiLlama's public reserve data for every centralised trading venue it covers. There are 88 exchanges on file, 80 of which have a weekly figure. cryptoticker.io compiled this analysis itself on September 29, 2026.
Over the week Bitget records a net outflow of $842.1 million. That is the second-largest figure in the entire field; only Bitstamp is higher at $884.7 million. Measured against its own reserves, the outflow at Bitget weighs 14.4 percent. Over the month there is a deficit of $322.1 million, so the outflow arose almost entirely in the past week.
Two further values from the same analysis frame the picture. First, a weekly outflow is no isolated case at the moment: 40 of the 80 houses with a weekly figure are in deficit, among them Binance at $735.0 million. Second, the direction at Bitget is turning. For the most recent 24 hours, the reserve data on the evening of September 29 shows a slight inflow of $12.0 million. The large outflow wave therefore sits in the hours around the reopening of withdrawals, and at the time of this analysis it had not continued.
One detail in the same data set deserves attention, because it applies at every exchange and is rarely explained. Of the $5.84 billion in reserves, $455 million, or 7.8 percent, sits in Bitget's own token BGB. DefiLlama reports that share separately and calls the rest clean reserves, in Bitget's case $5.39 billion.
The reason for showing it separately: the price of a house token hangs on the fate of the exchange that issues it. If the house gets into trouble, the part of the reserves meant to cover that trouble falls hardest. For an assessment of the backing, the clean figure counts, not the large one.
Proof of reserves is a verification method with which an exchange shows that the holdings on its addresses cover its customers' balances. Technically, all customer balances are combined into a Merkle tree, a tree structure of checksums in which every customer can recalculate their own position without seeing anyone else's. Bitget publishes this proof monthly and provides the check on a page of its own.
The proof has a gap that is decisive for any assessment: it shows assets, but no liabilities. An exchange can report full reserves and at the same time carry loans or obligations that appear nowhere. A proof of reserves is therefore a snapshot of the asset side, not a balance sheet and not an audit by a supervisory authority. The reserve data in this article shares that limit.
A user protection fund is a voluntary arrangement. It comes into being by company decision, its size changes at the company's discretion, and there is no legal entitlement to it. Statutory deposit insurance, which at a German bank covers €100,000 per customer, does not apply to crypto balances in any case, because it protects money deposits, not tokens.
From that follows a practical rule for custody. Any balance you are not actively trading sits on an exchange with no claim to protection. Anyone who wants to switch that part of the risk off holds their own coins, and for that you need a device that keeps the private keys offline. Which devices do that and how they differ is set out in the hardware wallet comparison. Self-custody switches off the counterparty risk and replaces it with responsibility for your own recovery phrase. That shift is the real core of the decision, and it falls differently depending on the amount and on experience.
Self-custody takes the risk away from the exchange and puts it on your own key management.
For German users there is a particularity that sets this case apart from an ordinary exchange incident. Bitget holds no licence as a crypto service provider under the EU regulation MiCA. Since January 16, 2026 the company has accepted no new registrations from Germany, and Germany is listed as a blocked country in its terms of use. The company explained the step in a notice to users in France and Germany.
In practice that means: anyone still holding a balance there is a legacy customer of a platform that may no longer offer services in Germany. The supervisor BaFin has no jurisdiction over the house, no complaints route through a German authority is open, and the liability rules MiCA imposes on licensed providers for custody and asset segregation do not apply here. What obligations a licence brings with it, and which deadlines apply to providers, is set out in our overview of the MiCA obligations for crypto companies.
A side effect concerns tax. A transfer from an exchange to your own wallet is not a sale and triggers no tax, because the beneficial owner does not change. The one-year holding period under Section 23 of the German Income Tax Act keeps running through a transfer. All that matters is that you keep the acquisition date and acquisition cost documented, because the exchange may no longer supply that information once an account is closed.
The order of the timetable follows technical difficulty, not customer size. Bitcoin opened on September 28, then Ether and USDT, and on October 2 the remaining tokens, fiat money and peer-to-peer trading follow. Fiat comes last because banks and payment providers are involved, and their checks are not something the company controls on its own.
How do you tell whether the timetable holds? One reliable sign is the actual duration of a withdrawal compared with the announced one. A second is the reserve data: if holdings stay stable while customers withdraw, the house is topping up. A third is whether announced dates are met without new conditions. If October 2 slips without explanation, that is a different signal from a delay with a named reason.
Counterparty risk means this: your coins on an exchange are legally a claim against the company, not direct ownership of an asset. As long as the house is solvent and the systems run, the difference does not show. An attack makes it visible.
This week's figures show both sides. On one side the protection fund carried the damage, withdrawals are running again, and the outflow did not continue after the first hours. On the other side the cushion has been halved, and a second incident in short order would meet a much thinner blanket. Seeing both at once is the sober reading, and it leads neither to panic nor to complacency.
For your own allocation, one simple rule of thumb follows, and it holds regardless of this case: what sits on an exchange is what you intend to trade in the foreseeable future. Everything else sits in self-custody or with a provider under a supervisor you can turn to in a dispute.
(As of September 29, 2026. This article is not investment advice. Prices and fee structures change; check the terms with the provider before you buy.)
