Bitget's 5,500 BTC protection fund matches its $387.5 million breach only above about $70,450 a coin

Divide the $387.5 million that Bitget says moved to attacker-controlled addresses ^[1] by the 5,500 bitcoin in its protection fund ^[12] and you get about $70,450 ^[1]. At that bitcoin price the fund's dollar value equals the loss. Above it the backstop exceeds the loss, and below it the fund falls short, with each $1,000 move in the coin adding or removing about $5.5 million of cover ^[2]. The $387.5 million is the amount transferred out, so any sum later frozen or recovered would lower both the loss and the break-even price ^[1][12].

The loss figure has already moved once, by $35.9 million, or about 10% on the first estimate ^[3]. Bitget said the revision did not represent a fresh wave of unauthorized transfers ^[4].

Bitget set 04:00 UTC on Sept. 26 as its deadline for a withdrawal plan or status ^[6]. That was 33 hours and 29 minutes after it detected the transfers at 18:31 UTC on Sept. 24 ^[2][4]. Through that window the exchange kept taking deposits and running its trading book ^[5]. Money could come in but not go out. A displayed balance and the ability to trade "do not by themselves provide an exit while withdrawals are paused," CryptoSlate wrote ^[14].

Sygnum's Protect route was built for a different customer. An eligible institution onboards with the bank, signs a contractual framework, opens a Protect portfolio and pledges bitcoin, ether, stablecoins or US Treasuries before it gets exchange margin ^[8]. Sygnum says the collateral sits in segregated accounts off its own balance sheet and is bankruptcy remote under Swiss banking law ^[9]. On that description, pledged collateral was held in Switzerland, outside the Bitget wallet layers the attacker reached ^[7][3].

Sygnum announced the Bitget integration on the day of the breach ^[7]. Neither company has said when client access went live, how many Bitget clients use it, whether Sygnum-held collateral was connected to the incident, or what the Bitget-specific contract says about releasing collateral during a withdrawal pause ^[10][11]. Even for a client whose collateral is pledged, orders, margin and settlement still run through Bitget ^[11]. The evidence shows the route was open only to eligible institutions. It does not show that the route shielded any of them this week.

The plan could reopen every balance at once without touching the fund, and in that case the bitcoin price matters to no customer. A staged return would leave retail balances carrying the wait. If the fund is drawn, its value on that day sets how much of the $387.5 million it covers ^[1]. I'd expect ordinary customers' exposure to sit in those last two cases. The one route that kept assets out of Bitget's wallets required onboarding with a Swiss bank ^[8].

The case against that view is Bitget's own account. It says its cold wallets stayed secure ^[3], and that it has remediated the vulnerability and contained the incident, with Mandiant and SlowMist assisting ^[13]. If Bitget publishes a plan by 04:00 UTC on Sept. 26 that reopens withdrawals in full with no draw on the fund, retail customers will have lost 33 hours of access and no money ^[4].