Bitget

Is Bitget safe?

The honest answer in October 2026 is that it is too early to know. On 24 September hackers took $387.5 million from Bitget's wallets. Bitget says no customer balance was touched and that its User Protection Fund covers the whole loss, and it restarted withdrawals in phases over the following week. On 30 September it said it had topped the fund back up to more than $300 million. If that holds, customers will have been made whole, as at Bybit in 2025.

Even before the breach, Bitget was a lightly regulated offshore exchange with no EU licence and no audited accounts. We score it 49/100 with low confidence, because the full facts of the incident are not yet public.

What happened on 24 September 2026

Bitget's systems flagged unauthorised transfers at 18:31 UTC. Its first estimate was $351.6 million; four days later it raised the figure to $387.5 million after further on-chain tracing. The stolen assets were spread across many coins and chains, including XRP, ether, USDT, USDC, Zcash, BNB, AVAX, TRX and Tether Gold.

Chief executive Gracy Chen said attackers had compromised a backend system in the wallet infrastructure and used it to spoof transaction data, rather than stealing private keys. Bitget later said the vulnerability in its withdrawal systems had been fixed. It is working with Mandiant and SlowMist, and said early evidence pointed to North Korean-linked attackers, which it called a lead rather than a confirmed finding. On 1 October the analytics firm Chainalysis, which is helping Bitget and law enforcement trace the funds, attributed the theft to North Korea-linked actors. By its count, the $387 million left Bitget in 23 transfers within three hours, and much of the stolen XRP was swapped into bitcoin through a cross-chain protocol. Chainalysis says the theft takes North Korea's crypto haul for 2026 past $1 billion. This is the analytics firm's attribution, not a finding by a court or government.

On 30 September Bitget published interim reports from both forensic firms. Mandiant's status report says the attacker gained privileged access to two third-party security appliances on Bitget's network, planted a web shell and used that foothold to push malicious packages to the server that runs wallet jobs. SlowMist found that a zero-day flaw in one of those products had been exploited as early as 31 August, more than three weeks before the theft, and recovered a custom withdrawal tool that forged risk-control parameters. Both firms say private keys were not taken and cold walletsCold storageKeeping crypto keys on a device or medium that is not connected to the internet, which protects them from most online attacks.More in the glossary were untouched. Both investigations were still open.

Trading and deposits continued while withdrawals were paused. Bitget's schedule was bitcoin on 28 September, ether on 29 September, USDT on 30 September and all other assets, fiat and peer-to-peer trading by 2 October.

Can the Protection Fund cover it?

Bitget says it did. It launched the fund in December 2022 with $300 million and said it held more than $464 million at the time of the hack, above the $387.5 million loss. After using the fund to cover the loss, it promised on 28 September to rebuild it to at least $300 million within a week, and on 30 September said it had done so. But the fund is Bitget's own money, mostly in bitcoin and stablecoins, whose value moves with the market. It is not insurance and no regulator stands behind it.

The fund is now about a third smaller than before the hack, so the cushion for the next problem is thinner: Bitget's fund page showed $306 million on 10 October. Chief executive Gracy Chen promised a full incident report; beyond the interim forensic reports, it had not appeared by 10 October. We will update this page when it does.

Reserves and custody

Bitget publishes a monthly proof of reservesProof of reservesA report in which a crypto exchange shows that it holds enough coins to cover all customer balances, ideally checked by an outside firm.More in the glossary with a Merkle treeMerkle treeA way to combine many records into one short code, so that each person can check their own record is included without seeing anyone else's.More in the glossary, so users can confirm their balance was counted against on-chain wallets. It is self-published and not attested by an accounting firm, and there are no audited financial statements, so you cannot see the company's other debts.

The breach also tells you how custody worked in practice: hundreds of millions of dollars could be moved from hot and warm wallets through a single compromised system. Cold storageCold storageKeeping crypto keys on a device or medium that is not connected to the internet, which protects them from most online attacks.More in the glossary was not affected, according to Bitget.

Licences

Market	Status
EU	No MiCAMiCAThe EU's Markets in Crypto-Assets Regulation, which requires crypto exchanges and other providers to be licensed and supervised.More in the glossary licence; no Bitget entity on ESMA's register after the 30 June 2026 deadline
UK	Back since November 2024 on promotions approved by Archax Ltd; Bitget itself is not FCA-registered
US	Not available
Elsewhere	Registrations in Australia, El Salvador and some other markets

The UK row needs care. Under the FCA's promotion rules an offshore exchange may market to UK customers if an FCA-authorised firm approves its adverts. Bitget's UK page says "Approved by Archax LTD on 15/10/2024" and carries the FCA's standard warning that this is a high-risk investment and you should not expect to be protected if something goes wrong. The approval covers what Bitget may say to you, not how it holds your money.

For EU residents this matters now. Without a MiCA licence Bitget should not be serving you, and if something goes wrong you have no EU regulator to complain to.

Who should be careful

• Anyone holding savings on Bitget while the incident is still being investigated.
• EU residents, who no longer have a licensed service from Bitget.
• Copy-trading and futures users. Bitget is known for copy trading and high leverage, which can lose money much faster than any hack.

Practical steps

1. Check that your balance and recent transaction history look right, and that withdrawals now work for the coins you hold.
2. Turn on a passkeyPasskeyA way to sign in without a password. Your device holds a key tied to one website or app and unlocks it with your fingerprint, face or PIN.More in the glossary or authenticator app, the anti-phishing code and the withdrawal address whitelist.
3. Expect phishing that uses the hack as bait, such as "claim your compensation" links. Bitget says balances were not affected, so there is nothing to claim.
4. Keep only active trading funds on any exchange.

How we scored it

Legal record (60) is Bitget's strongest factor, as we found no criminal cases. Licensing (30) is the weakest, with no MiCAMiCAThe EU's Markets in Crypto-Assets Regulation, which requires crypto exchanges and other providers to be licensed and supervised.More in the glossary, UK or US licence; approved UK adverts are not a licence. Security history (60) reflects the September 2026 breach: Bitget says customers lost nothing and withdrawals were back by 2 October, which puts it in the band we use for a hack covered in full, level with Bybit. It stays at the bottom of that band because withdrawals paused for up to eight days, the intruder sat in the network for three weeks, and only interim forensic reports are out. Compare KuCoin, which covered a similar-sized hack in 2020.