Bitget

Bitget’s systems flagged unauthorised transfers out of several hot wallets at 18:31 UTC on 24 September 2026. The total was $351.6m across nineteen separate transactions drawing on hot and warm wallet infrastructure; cold storage was not touched. It is the largest confirmed theft from a centralised exchange this year.

The mechanism matters more than the number, and it is being reported reassuringly when it should not be. By Bitget’s own account, attackers compromised a wallet backend, spoofed transaction data and fed it into the exchange’s authorisation process, which then approved the transfers. Private keys were not stolen. That means the keys are intact and the logic in front of them failed — harder to audit, harder to prove clean afterwards, and precisely why withdrawals are still suspended rather than resuming after a key rotation.

Chief executive Gracy Chen has said state-linked hackers are very likely responsible, citing IP addresses tied to VPN services a North Korean group has used before. She named no group, and some analysts dispute a direct Lazarus link. Infrastructure reuse is weak evidence, and attribution changes nothing about whether the money comes back. We cover the incident in full in our report on the breach.

Bitget says its User Protection Fund holds over $464m, comfortably more than the $351.6m taken. We examined that fund in July 2026 while scoring exchanges — before any of this happened — and the finding cuts both ways.

In Bitget’s favour, and this is genuinely unusual: the fund is one of the few in the industry scoped to theft. It has a stated trigger — users can claim if assets are stolen through no fault of their own — and it is held separately. Most exchange “insurance” is a vague pool with no published trigger that turns out not to cover the event that occurs. On the narrow question of whether this hack is the kind of event the fund exists for, the answer appears to be yes.

Against it: we could not verify the fund. Bitget says it is monitorable through public wallet addresses and does not print those addresses on the fund page. Its own figures for the size disagree between that page and its blog — and the $300m cited in its wallet-security material sits beside the $464m claimed now. When we opened its proof-of-reserves page, the reserve-ratio table rendered “No data found”, with no attestor named. We scored Bitget 5 out of 10 on custody for those reasons in July.

None of that means the money is not there. It means that at the moment users most need to check — withdrawals suspended, an exchange asking to be believed — the machinery for checking is the machinery we found empty. Publishing the fund’s on-chain addresses would convert the central claim into something anyone can verify in a block explorer, and that is the single thing most worth watching for.

There is one precedent in Bitget’s own history worth weighing, and it runs in its favour. When BitKeep — the wallet it acquired and rebranded — lost roughly $8m to a malicious app build in December 2022, every one of the 11,090 affected wallets was reimbursed, confirmed by 29 March 2023. That is a rare unambiguous yes in a category where “reimbursement pledged” usually goes unconfirmed forever.

Bitget Wallet is a non-custodial wallet: you hold the private key and the recovery phrase, and Bitget cannot move, freeze or lose your funds in it. That distinction is the single most useful thing to know this week, because the exchange’s suspension of withdrawals does not apply to it. Assets in the wallet were never in Bitget’s custody and are unaffected by the breach of its hot wallets.

The product’s history is not Bitget’s. It began as BitKeep, an independent multichain wallet, and Bitget acquired it in March 2023 after a $30m fundraise, rebranding it and changing management and security practices. That history includes a serious incident: in December 2022, before the acquisition, attackers distributed a malicious build of the Android app through phishing sites, and users who installed it from outside the official channel lost an estimated $8m. BitKeep reimbursed all 11,090 affected wallets, confirmed by 29 March 2023.

The lesson from that incident is the one that still applies and has nothing to do with Bitget: a self-custody wallet is only as safe as the file you installed. The December 2022 losses hit people who downloaded an APK from a search result rather than an official store. Install from the official channel, verify the domain, and the attack that caused those losses cannot reach you.

On current security, the wallet integrates the Go+ service to flag malicious addresses and contracts before you sign — useful, and worth understanding for what it is: a blocklist, not a guarantee. A novel drainer contract that nothing has reported yet will pass. The protection that actually holds is reading what you are signing, and no wallet can do that for you.

There is also a card product attached to the wallet, letting balances be spent through conventional payment rails. Card programmes in crypto depend on an issuing bank and a card network, both of which have withdrawn from crypto partners before with little notice, so treat availability in your country as a thing to check today rather than a permanent feature.

The account and the app work normally: you can sign in, see balances, deposit and trade. What you cannot do is withdraw, and that has been true since 24 September 2026. Before you log in, understand what a suspension means for the balance you are looking at — the number on screen is Bitget’s statement of what it owes you, not proof it holds it.

Two practical cautions specific to this moment. First, the only address to sign in from is bitget.com; a suspension of withdrawals is exactly when phishing domains proliferate, because people search for a login rather than using a bookmark, and a fake login page harvesting credentials during a real outage is the oldest play in the book. Second, nobody from Bitget will contact you offering to expedite a withdrawal or recover funds. Every message that does is a fraud, and breach weeks generate them in volume.

If you are already holding a balance there, the operational reality is that trading remains open, so the only ways to change your position are to trade within the platform or to wait. That is not advice on what to do; it is the constraint. Whether to keep depositing into a venue whose withdrawals are closed is a judgement about how much you trust an unverified statement of solvency, and we cannot make it for you.

Watch for two things rather than for reassurance. The length of the suspension: a security halt typically ends within days alongside a published post-mortem, while a solvency halt extends and acquires conditions, and the two look identical from outside on day one. And whether withdrawals reopen in full or under caps — caps, staged limits or a queue tell you something the announcement will not.

A $10,000 bitcoin buy cost 0.10% on our 14 July 2026 run — the cheapest of any venue we priced, and 2.6 times cheaper than Kraken on the same day. The published 0.1% taker fee is effectively the whole bill at that size, with measured slippage of zero against best ask, and the fiat rails are the strongest in the second tier: SEPA at €1 out, USD by SWIFT, plus BRL, MXN, PLN, AUD and CAD, with a published fee table.

The advantage narrows as size grows, and the reason is depth. We measured 93.2 BTC within 0.1% of best ask and 170.7 BTC within 0.5% — roughly half Kraken’s book at both levels. At $100,000 that showed up directly: slippage of 0.0081% against Kraken’s 0.001%, eight times as much. Effective cost still came out ahead, 0.1081% against 0.261%, so the venue remains cheaper; the margin is simply not what the headline fee implies, and it keeps shrinking with size.

Infrastructure is the weaker half. We measured 521 ms of API response latency, more than twice Kraken’s 224 ms and slower than Binance’s 460 ms, and Bitget publishes no status page — so during an outage there is no official source telling you whether the problem is yours. In a week with withdrawals suspended, the absence of a status page stops being a documentation quibble and becomes the reason rumour fills the gap.

Copy trading is the product Bitget is best known for, and the arithmetic deserves stating plainly: you pay the lead trader a share of profits on top of the trading fee, which means the cheapest fee schedule in the category stops being cheap the moment you use the feature the platform is famous for. Past returns of a lead trader are a record of a period, not a forecast, and the ones displayed most prominently are selected by the platform.

The United States and its territories are Prohibited Countries under Bitget’s own terms of use, which also forbid using a VPN to get around the restriction. That is a contractual term rather than a geoblock to be worked around: breaching it is grounds for the account to be closed with the balance frozen, and a frozen balance at a venue that has already suspended withdrawals is a poor place to test the point.

In Europe it has no MiCA authorisation. An application is pending with the Austrian financial market authority, and Bitget’s own July 2026 notice states that authorisation has not been granted and the outcome remains with the regulator. It has already exited France, with withdrawals due by March 2026, and blocked new German sign-ups. Its terms also list Austria itself as a prohibited country, which sits oddly beside an Austrian licence application.

The practical reading is that Bitget’s regulatory position in both of its largest addressable Western markets is either closed or unresolved, and the current suspension is happening while that is true. A venue with a home regulator has a supervisor to answer to when withdrawals stop. This one does not yet, which is why the length of the suspension is the only signal available.