The cover is priced in bitcoin

Bitget reopened bitcoin withdrawals at 08:00 UTC on Monday, four days after its security systems detected unauthorised transfers out of its hot wallets at 18:31 UTC on 24 September. Ether follows on Tuesday, tether on Wednesday, and everything else, including fiat and peer-to-peer trading, on 2 October, according to the schedule on the exchange's own support site. By 08:25 it had posted a second notice asking users to be patient with withdrawals stuck "Under Review", which it put down to slow bitcoin block times.

The reassurance underneath the schedule is a single sentence from the chief executive, Gracy Chen: "The full amount of this loss falls within the coverage of Bitget's User Protection Fund, which currently holds over $464 million." It is true. It is also a sentence with a price in it, and the price is not fixed.

Start with the loss, because there are three figures in circulation. The first, $351.6m, was the number everyone printed on Thursday and Friday. Chen then gave $387.5m, and Bitget's revision cited the "latest onchain tracing and classification of transactions", according to Electronic Payments International. The Hacker News puts the total transferred to attacker-controlled addresses at $390.06m. This piece uses the company's own revised figure, $387.5m. The attacker did not take private keys, Chen said: they "compromised a critical backend system within our wallet infrastructure, used it to spoof transaction data, and triggered our authorization process to move funds out."

Now the fund. Bitget's Protection Fund page lists its holdings as 5,500 BTC, updated on Monday, and says the dollar value shown is based on bitcoin's price at midnight UTC each day. It is not a dollar reserve. Chen's "$464 million" is 5,500 multiplied by roughly $84,400, which is where bitcoin traded on the day of the hack. Coinbase's daily data has it closing 24 September at $84,385.46, a fund value of $464.1m.

At 13:04 UTC on Monday, with bitcoin down on the same rising-yield, rising-oil morning that has weighed on it since last week, Coinbase's spot price was $83,393.99. The fund was worth $458.7m. The cushion over the loss was $71.2m.

Divide the loss by the holding and you get the number that matters: $70,454.55. Above that bitcoin price, the fund covers the hack. Below it, it does not. Bitcoin would need to fall 15.5 per cent from Monday's price to get there, and September alone has seen closes as low as $75,584 and as high as $86,595. That is a range of 14.6 per cent in one month.

The year gives a blunter answer. Of the 270 daily closes from 1 January to 27 September, 126 were below $70,455, and the most recent was 19 August, five and a half weeks ago. Bitcoin's lowest close of the year was $58,523.93 in June; at that price the fund would have been worth $321.9m, about $66m short of the loss. Using the smaller $351.6m figure, the threshold is $63,927, and bitcoin closed below that on 48 days this year, most recently on 16 August.

There is a second mismatch, and it runs the other way. The loss was not taken in bitcoin. The attacker moved ether, XRP, BNB, AVAX, USDT and USDC across Ethereum, the XRP Ledger, Arbitrum, Avalanche, Optimism, BNB Chain and Base. The stablecoin share of the hole is fixed in dollars; the rest moves with its own tokens, which tend to move with bitcoin. A fund in one asset set against a loss in six is a hedge only roughly, and the part that is fixed in dollars is the part it hedges worst. Circle and Tether have frozen $339,100 of stablecoins linked to the theft, The Hacker News reports, which is less than a tenth of 1 per cent of it.

None of which means Bitget cannot pay. Chen has said the company holds more than $1bn of its own assets beyond the fund, according to CryptoSlate. She has pointed to Bybit, which was drained of $1.5bn last year and stayed open: "If Bybit can hold on [after] a $1.5 billion loss, we can definitely hold on to a $350 million+ loss," she told The Record. The point is narrower. "Falls within the coverage" is a statement about one day's bitcoin price. Held in bitcoin, the fund's cover goes up and down with every close.

The attribution is not settled, but it is consistent. Chen told The Record that "IP addresses, behavioral patterns and on-chain signatures indicated that the attack is tied to North Korean-linked hacker groups", and researchers have linked the laundering to the TraderTraitor cluster behind the Bybit theft. If that holds, The Hacker News's tally puts North Korea at $1.04bn stolen this year. As this desk noted this month, what gets recovered from such thefts tends to be measured in tens of millions, not hundreds.

Bitget has not said how the fund will be drawn, whether any of the bitcoin will be sold, or at what price the loss will be booked against it. Until it does, the most precise description of its cover is not a dollar figure. It is a bitcoin price, $70,455, and a count of how often this year the market has been below it.