Bitget recorded $231 million in user deposits over the 24 hours ending September 30, according to exchange data, a figure roughly 6% below the platform's August daily average of $245 million. The deposit flow arrived six days after the exchange suffered one of the largest centralized exchange security breaches of 2026 and just two days after it began phasing withdrawals back online.

The shortfall against the August baseline works out to approximately $14 million per day in reduced inflows — a measured, not catastrophic, decline for an exchange that lost an estimated $387.5 million to $390 million in the incident.

The mechanics of the breach

On September 24, attackers compromised Bitget's security infrastructure through what amounted to a forgery operation. The intruders fabricated internal transfer requests that the exchange's systems accepted as legitimate, draining nearly $390 million from Bitget's hot and warm wallets — the more accessible layers of its custody setup.

Bitget froze withdrawals across the platform, launched an internal audit, and reopened withdrawals in phases beginning September 28. The staged resumption covered BTC first, followed by ETH and USDT between September 28 and 30.

When the gates opened, the exchange recorded a single-day net outflow of $463 million — a platform record, and a figure that exceeded the total amount stolen in the hack itself. The outflow tested but did not break the exchange's liquidity position.

Reserve coverage and trading metrics

Bitget's most concrete defense of its solvency came on September 29, when it published a Proof of Reserves report showing a 131% reserve ratio across 19 assets. The exchange holds $1.31 in reserves for every $1.00 in user deposits, according to the report.

Trading activity has also held through the recovery period. Futures trading volume reached $9.2 billion as of September 29, with open interest standing at $4.4 billion.

The relatively contained fallout likely reflects that reserve coverage. A 131% ratio is a strong competitive card for Bitget, but Proof of Reserves reports carry inherent limits: they are point-in-time snapshots, not guarantees. They show what sits in the vault on a given day, not whether an attacker can breach it the next.

Operational consequences

The breach exposed a specific weakness in Bitget's internal transfer verification process — spoofed requests treated as genuine — rather than a failure of cold-storage custody. That distinction matters for how the exchange rebuilds institutional confidence, because it points to procedural controls rather than the custody architecture itself as the failure point.

The $231 million deposit figure on September 30 also signals that user retention has not collapsed. An exchange bleeding trust after a breach typically sees deposit inflows fall by multiples of its prior baseline, not single-digit percentages. The data suggests a substantial portion of Bitget's user base chose to stay through the freeze-and-reopen cycle, even as the record $463 million outflow shows a meaningful cohort exited at the first opportunity.

The roughly $14 million daily gap in inflows versus August represents real but manageable revenue pressure for a platform of Bitget's scale, particularly with futures volume still running above $9 billion daily.

What comes next

The internal audit Bitget launched after freezing withdrawals has not yet produced a published post-mortem detailing exactly how the spoofed transfer requests passed verification. A technical explanation of that failure, along with evidence of remediated controls, will likely determine whether the deposit baseline converges back toward the August average in the weeks ahead.