Updated Rules checked 2026-10-22
No exchange can guarantee safety, and Bitget is no exception; what you can verify comes down to three things. First, Bitget was hacked on 2026-09-24: about USD 388 million was moved out of some of its hot and warm wallets. Bitget says the loss was covered by its protection fund and user account balances were not affected; withdrawals reopened in stages and were fully restored on 2026-10-02. Second, Bitget’s latest proof of reserves is the 2026-10-21 snapshot, with a total reserve ratio of 115%: BTC 113%, ETH 162%, USDT 105%. Third, Bitget’s official regulatory license page lists registrations or licenses in 9 jurisdictions, such as a digital currency exchange provider registration with Australia’s AUSTRAC and a CASP license in South Africa.
This article does not call Bitget “safe” or “unsafe.” It only collects dated information with official sources: the timeline of the hack and how it was handled, the proof of reserves figures and how to verify them yourself, the licenses Bitget lists, how to confirm that a website or app is genuine, which account security settings to turn on, and which regions cannot use Bitget. Whether you keep money on Bitget, and how much, is your call.
Key points:
1. Bitget was hacked on 2026-09-24: about USD 388 million left its hot and warm wallets, across 12 wallet addresses. Bitget says no private keys were leaked, cold wallets were not affected, and the loss was covered by the protection fund.
2. Deposits and trading never stopped during the incident. Withdrawals reopened coin by coin: BTC on 2026-09-28, ETH on 09-29, USDT on 09-30, and other coins, fiat and P2P on 2026-10-02, about 7.5 days in total.
3. Bitget’s reserve snapshot of 2026-10-21 12:00 (UTC+8) shows a total reserve ratio of 115%: BTC 113%, ETH 162%, USDT 105%, USDC 101%. It covers 19 assets and is verified with a Merkle tree.
4. The developer of Bitget’s official app is BG LIMITED on both the App Store and Google Play, and the official domain is www.bitget.com.
5. Bitget’s English terms of use, updated 2026-10-20, list prohibited countries including the United States, Canada, Japan, Hong Kong, Singapore, Malaysia, Thailand and Russia.
The information below was checked against official pages on 2026-10-22 (fact-check date) and is provided for your reference.
Has Bitget been hacked? How did it handle it?
Yes, on 2026-09-24. Bitget’s security incident page (updated 2026-10-13 00:00 UTC) says this was the first incident of its kind in Bitget’s 8 years of operation. The attackers exploited a zero-day vulnerability in a third-party security product used by Bitget to steal high-privilege internal credentials, then wrote forged withdrawal instructions directly into the wallet system, bypassing risk controls to move coins out of the hot and warm wallets, and afterwards deleted traces of what they had done. Bitget’s final tally is about USD 388 million across 12 wallet addresses on 11 chains. No private keys were leaked, and the cold wallets holding most of the platform’s assets were not breached.
| Time (UTC) | Event in Bitget’s official record |
|---|---|
| 2026-09-24 18:31 | The attackers make the first unauthorized transfer from some hot and warm wallets |
| 2026-09-24 19:05 | The reconciliation system detects the anomaly; the risk control system automatically blocks withdrawal requests across the platform |
| 2026-09-24 19:14 | Highest-level emergency response activated |
| 2026-09-24 20:40 | With a private key leak not yet ruled out, the wallet team starts moving funds into cold wallets |
| 2026-09-25 08:43 | The security team identifies the root cause |
| 2026-09-25 13:42 | Reported to law enforcement where the relevant Bitget entities are based |
| 2026-09-28 08:00 | BTC withdrawals reopen |
| 2026-09-29 08:00 | ETH (Ethereum, BSC, Arbitrum, Base, Optimism) withdrawals reopen; at 15:59 the 47th proof of reserves is published, with a total reserve ratio of 131% |
| 2026-09-30 | 05:20 independent investigation reports by Mandiant and SlowMist published; 08:00 USDT (Ethereum, BSC, Solana, Tron) withdrawals reopen; 09:00 more than USD 300 million put back into the protection fund |
| 2026-10-02 08:00 | Withdrawals of other coins, fiat and P2P reopen; the phased recovery plan is complete |
Sources: Bitget incident timeline (updated 2026-10-20) and the Bitget security incident page, checked 2026-10-22.
The direct impact on users was the withdrawal pause. Counting from 19:05 on 09-24, when the system blocked withdrawals, BTC users waited about 3.5 days and other coins, fiat and P2P about 7.5 days; I calculated these day counts from the official times. Bitget states that the recovery order depended only on the coin, not on account level, with no VIP priority; deposits and trading continued as usual during the incident.
On the loss itself, the FAQ on the incident page says that at the time the protection fund held 5,500 BTC, worth more than USD 464 million, and was designated to cover the entire loss, which would not be passed on to user balances. The loss of about USD 388 million was roughly 84% of the protection fund at the time. On 09-28 Bitget pledged to put at least USD 300 million back into the fund within a week, and on 09-30 it announced this was done (Bitget announcement); the incident page currently shows 3,705 BTC, more than USD 314 million. To recover funds, Bitget published the attackers’ addresses and offers anyone who helps freeze or recover funds a bounty of 5% of the amount frozen or recovered. The page gives no figure for how much has been frozen or recovered so far; it only points to a live tracking dashboard.
After the incident, people posed as support staff offering to “help recover assets” or “restore withdrawals.” Bitget states on the incident page that it will never ask you to transfer funds for these reasons, or ask for your password, private key, seed phrase or verification codes; anyone who asks you to pay first before you can withdraw is a scammer. Common scripts are covered in fake exchange withdrawal scams. Other exchanges’ hacks and withdrawal pauses are listed in exchange safety records.
How to read Bitget’s proof of reserves (PoR)
Bitget publishes its proof of reserves every month and uses a Merkle tree so users can confirm their own balance was included. Data read from the Bitget proof of reserves page on 2026-10-22 shows that the latest edition is already the second snapshot since the hack:
| Item | 2026-10-21 12:00 (UTC+8) | 2026-09-29 17:00 (UTC+8) |
|---|---|---|
| Total reserve ratio | 115% | 131% |
| BTC | 113% | 142% |
| ETH | 162% | 110% |
| USDT | 105% | 107% |
| USDC | 101% | 154% |
| User BTC / platform BTC | 27,249.03 / 30,762.12 | 20,531.72 / 29,099.61 |
| Platform’s surplus BTC | About 3,513.09 | About 8,567.88 |
| Assets covered | 19 | 19 |
Source: data endpoints of the Bitget proof of reserves page (queryTotalReserveAmount, queryPlatformReserveDetail), read 2026-10-22. Platform BTC is the sum of on-chain holdings on Bitcoin mainnet, BSC, the Lightning Network and other chains. The figures change every month; the current edition on the page prevails.
Comparing the two editions, the BTC reserve ratio fell from 142% to 113% because users’ BTC rose from 20,531.72 to 27,249.03 coins while platform BTC grew by only about 1,662 coins, so the surplus shrank from about 8,567.88 to about 3,513.09 coins. ETH went the other way, from 110% up to 162%. The total reserve ratio’s drop from 131% to 115% also has to be broken down by coin, and by whether the user side or the platform side changed; it cannot simply be read as the platform having less money. In addition, the FAQ on Bitget’s incident page still says “comprehensive reserve ratio 127%,” which differs from the latest figure on the reserves page; go by the current figures on the reserves page.
PoR only proves that, at the moment of the snapshot, the user assets included in the calculation were backed by corresponding on-chain assets. Bitget’s page does not state whether the company’s own liabilities are included, and it does not name a third-party auditor. The protection fund is a separate pool of money: 3,705 BTC divided by the latest user BTC figure of 27,249.03 coins is about 13.6%, compared with about 18.0% in the previous edition. The protection fund has to cover every coin, so this ratio only gives a sense of scale; it is not a payout cap.
How do you verify that your balance was included?
After logging in, click “My proof of assets” on the proof of reserves page to see your account’s data in the current Merkle tree. If you want to verify it yourself, the steps in Bitget’s open-source verification tool guide on GitHub are:
- Download the verification program for your operating system (there are Linux, macOS and Windows versions) and unzip it into a folder.
- Download your own merkel_tree_bg.json and replace the file with the same name in the folder.
- Run start.sh (start.bat on Windows).
- Check the result: “Consistent with the Merkle tree root hash. The verification succeeds” means it passed; “Inconsistent” means it does not match.
It works by hashing upward from your own leaf node; the root you calculate must match the root hash published on the page. For a comparison of reserve ratios, update frequency and verification methods at 13 exchanges, see exchange proof of reserves compared.
Which countries has Bitget registered or been licensed in?
According to Bitget’s official regulatory license page (viewed 2026-10-22), Bitget lists the following registrations, licenses and approvals:
| Jurisdiction | Registration / license type (as Bitget words it) | Authority |
|---|---|---|
| Australia | Digital currency exchange provider registration | Australian Transaction Reports and Analysis Centre (AUSTRAC) |
| United Kingdom | Works with an FCA-approved platform and an authorized person to comply with section 21 of the Financial Services and Markets Act 2000 | Financial Conduct Authority (FCA) |
| Switzerland | Member of an anti-money-laundering self-regulatory organization (SRO) | A FINMA-recognized self-regulatory organization |
| South Africa | Crypto asset service provider (CASP) license, over-the-counter derivatives provider (ODP) license | Financial Sector Conduct Authority |
| Argentina | Virtual asset service provider | National Securities Commission (CNV) |
| Mexico | Registration for activities vulnerable to money laundering | Tax Administration Service (SAT) |
| El Salvador | Bitcoin service provider (BSP), digital asset service provider (DASP) | Central Reserve Bank (BCR), National Commission of Digital Assets (CNAD) |
| Mauritius | Investment dealer license (full-service dealer, excluding underwriting) | Financial Services Commission |
| Georgia (Tbilisi Free Zone) | Digital asset exchange, wallet and custody service provider | Tbilisi Free Industrial Zone |
Source: Bitget regulatory license page, viewed 2026-10-22; the page does not give the date each item was obtained or any registration numbers. Rules differ from country to country; the local authority’s announcements prevail.
Read this table item by item: a “registration,” a “filing” and a “license” are not the same thing. Australia’s AUSTRAC is the anti-money-laundering regulator, and this item is a registration as a digital currency exchange provider. The Mexico item is a filing with the tax authority for “activities vulnerable to money laundering.” For the UK item, Bitget’s wording is that it works with an FCA-approved platform and an authorized person; the page does not say that Bitget itself holds an FCA license. Switzerland means membership in a FINMA-recognized self-regulatory organization. Thailand is currently on Bitget’s prohibited country list. On 2026-10-20 Bitget announced a plan to acquire GMO-Z.com Cryptonomics (Thailand), a licensed Thai exchange, and the announcement states that completing the deal first requires local regulatory approval (Bitget announcement).
On the regulatory record, Japan’s Financial Services Agency (FSA) issued warning letters to Bitget Limited for operating without registration twice, on 2023-03-31 and 2024-11-28 (Japan FSA notice); records from other countries are in exchange safety records.
How do you confirm Bitget’s official website and app are genuine?
- Website: Bitget’s anti-phishing notice of 2024-08-08 says to trust only the official domain www.bitget.com. Bitget does send SMS notifications, but they usually contain no links. Be suspicious of any SMS or email with a link that says “a withdrawal is in progress.”
- Official verification tool: enter an email address, URL or social media account on Bitget’s official verification page to check whether it is an official channel. If a social media account claims to be support, check it there before you reply.
- App: the same notice reminds you to download the app only from Google Play, the Apple App Store or the official platform. As checked on 2026-10-22, the developer of the exchange app is BG LIMITED on both the App Store and Google Play. An app with a similar name but a different developer is not the Bitget exchange app.
- Bitget Wallet is a separate app: Bitget Wallet, which also carries the Bitget name, is a Web3 wallet whose developer on the App Store is BitKeep Global Inc.; it is a different product from the exchange app. Both show up in search results, so check which one you want before downloading.
Common tricks used by fake websites, fake support agents and fake apps are covered in crypto exchange scam types; if you are told to pay taxes or a deposit before you can withdraw, see fake exchange withdrawal scams.
Which security settings should you turn on for your Bitget account?
- Two-factor authentication: Bitget offers SMS, Google Authenticator and passkeys. Bitget “strongly recommends” Google Authenticator and passkeys, and warns that SMS codes can leak through SIM swapping (Bitget account security best practices).
- Passkeys: on the web, find “Passkey” under “Two-factor authentication” in the “Security Center,” click “Set up,” then click “Add.” Bitget states that a passkey is bound to the official domain and will not activate on a phishing site (passkey setup guide).
- Anti-phishing code: set an 8- to 32-digit numeric code in the “Security Center.” Once it is set, the code appears in official emails, SMS messages (except SMS verification codes) and on the login page; SMS messages show only the first 6 digits (anti-phishing code explainer, setup guide). If you cannot see your anti-phishing code on the login page, suspect that the URL is wrong.
- Withdrawal settings: “Withdrawal settings” in the “Security Center” has four options: the whitelist (withdrawals only to addresses in your address book), password-free withdrawals, withdrawal cancellation (you can cancel within 1 minute of submitting) and cross-device withdrawal confirmation (submit on the web, confirm in the app) (withdrawal settings explainer).
- Withdrawal holds after changing settings: after you change your password, update 2FA or modify security settings, withdrawals are restricted for 24 hours; after logging in on a new device, withdrawals from that device are restricted for 1 hour (withdrawal restrictions explainer).
Withdrawal steps and USDT fees on each network are in how to deposit and withdraw on Bitget; where to find the security settings at 13 exchanges is compared in exchange account security settings. Assets on an exchange are held in the exchange’s custody; for coins you don’t plan to trade for a long time, you can consider moving them to your own wallet, as explained in the crypto wallet guide.
Which regions cannot use Bitget?
The prohibited countries defined in Bitget’s English terms of use (updated 2026-10-20) are: Austria, Belarus, Canada, Cuba, France, Germany, Hong Kong, Iran, Japan, Kazakhstan, Malaysia, North Korea, Russia, Singapore, Sudan, the United States (including territories such as Puerto Rico and Guam and the US Minor Outlying Islands), Iraq, Libya, Yemen, Afghanistan, the Central African Republic, the Democratic Republic of the Congo, Guinea-Bissau, Haiti, Lebanon, Somalia, South Sudan, Thailand, and Ukraine’s Crimea, Luhansk, Donetsk, Kherson and Zaporizhzhia.
Watch out for version differences: when checked on 2026-10-22, the Traditional Chinese version of the same terms was still the 2026-06-16 version, and its list did not include Japan, Malaysia, Thailand, Belarus or Russia, nor Kherson and Zaporizhzhia. Go by the latest English version. Section 8.6 of the terms states that if you are in a prohibited country, the service may be blocked, which affects trading and viewing your orders and positions, and that you must not use a VPN or other means to get around the restriction. Restricted regions at 13 exchanges are compared in exchange restricted countries.
FAQ
Is it safe to keep money on Bitget?
No exchange can guarantee the safety of the money you keep on it; what you can check for Bitget is its record. On 2026-09-24 about USD 388 million was stolen from its hot and warm wallets, and Bitget says the protection fund covered it and user balances were not affected. The latest reserve snapshot, of 2026-10-21, shows a total reserve ratio of 115%, with BTC at 113% and USDT at 105%. Coins on an exchange are held in the exchange’s custody; for long-term holdings, you can consider moving them to your own wallet.
Did users lose money after the Bitget hack?
Bitget says no: user account balances are correct and unaffected, and the loss of about USD 388 million was covered by the protection fund. What was drained were the platform’s hot and warm wallets; the cold wallets and private keys were not affected. Withdrawals were fully restored at 08:00 (UTC) on 2026-10-02, and deposits and trading did not stop during the incident.
Could Bitget go bust?
No data can guarantee that an exchange won’t collapse, and proof of reserves can’t either. PoR only shows that at that moment on 2026-10-21, the user assets included in the calculation were backed by on-chain assets at 115%; the page does not state whether the company’s liabilities are included. Bitget says on the incident page that, according to its financial report as of August 31, its own funds (including the protection fund) exceed USD 1.4 billion. This is Bitget’s own statement, and Bitget does not say who audited the report.
What should I do if my Bitget withdrawal is stuck?
First check whether you recently changed your security settings: after you change your password, update 2FA or modify security settings, withdrawals are restricted for 24 hours, and after logging in on a new device, for 1 hour. Other common reasons are incomplete identity verification, coins tied up in open orders or Earn products, and maintenance on that network. For the full list of causes and fixes, see how to deposit and withdraw on Bitget and what to do if your exchange account is frozen. If someone asks you to pay first before you can withdraw, it is a scam.
How big is the Bitget protection fund?
The incident page (updated 2026-10-13) shows 3,705 BTC, more than USD 314 million. The protection fund was set up in 2022 with 5,500 BTC, and Bitget states that it maintains a minimum of USD 300 million. It covered the 2026-09-24 loss, and more than USD 300 million was put back on 09-30. Its wallet addresses are public on the Bitget protection fund page, which states that claims are subject to Bitget’s review.
Is Bitget licensed?
Bitget’s official regulatory license page lists registrations or licenses in 9 jurisdictions, including a digital currency exchange provider registration with Australia’s AUSTRAC, CASP and ODP licenses in South Africa, virtual asset service provider status with Argentina’s CNV, BSP and DASP in El Salvador, and an investment dealer license in Mauritius (viewed 2026-10-22). Each is valid only in its own jurisdiction; rules differ from country to country, and the local authority’s announcements prevail.
How can I tell whether a Bitget app is genuine?
Look at the developer name: the developer of the Bitget exchange app is BG LIMITED on both the App Store and Google Play (checked 2026-10-22). Bitget recommends downloading only from Google Play, the App Store or the official platform, and not tapping download links in SMS messages or emails. Bitget Wallet is a separate Web3 wallet app whose developer is BitKeep Global Inc.
Is Bitget a scam?
This site does not label exchanges as “scams” or “safe”; it only collects verifiable records. Bitget publishes its proof of reserves and its protection fund wallet addresses, and after the 2026 hack it reopened withdrawals on schedule. On the regulatory side, Japan’s FSA has twice issued warning letters to Bitget Limited for operating without registration. Fake websites, fake support agents and fake apps using Bitget’s name do exist, so check them through the official verification page.
For Bitget’s fees, products and who it suits, see the Bitget review. If you don’t have an account yet, the sign-up steps are in Bitget referral code, and identity verification is in the Bitget KYC guide. Hacks, withdrawal pauses and regulatory records at 13 exchanges are collected in exchange safety records.