Bitget

Bitget is a centralized crypto exchange best known for perpetual futures and copy trading, in which users automatically mirror the trades of lead traders. It also offers spot trading on more than 600 pairs, margin, bots, yield products, tokenized stocks and an on-chain trading section. The company describes itself as a "Universal Exchange" and claims 150 million registered users, over 1,800 employees from 60 countries and regions, and daily trading volume above 20 billion USDT.

Bitget says it was founded in 2018 by a team with a background in traditional finance. Gracy Chen is chief executive and the only executive named on its About page. Its Terms of Use, updated on 20 October 2026, name BTG Technology Holdings Limited as the company that operates the platform and say the terms are governed by Hong Kong law; Bitget does not state on those pages where the operating company is incorporated or headquartered, and it does not publish a street address.

BGB is the exchange's token. Paying trading fees in BGB cuts spot fees by 20%, and BGB balances count toward VIP tiers. Bitget also controls Bitget Wallet, a self-custody wallet that began as BitKeep; Bitget took a controlling stake with a $30 million investment at a $300 million valuation in March 2023 and renamed it.

At 19:05 UTC on 24 September 2026 Bitget's reconciliation systems detected unauthorised transfers from its hot wallets. The company's first notice put the loss at about $351.6 million, said cold wallets were untouched and the breach was limited to parts of the hot and warm layers of its three-tier wallet setup, and suspended withdrawals while keeping deposits and trading open. On 25 September Bitget raised the figure to about $387.5 million after counting transfers on Zcash and TRON, and published the attackers' receiving addresses on EVM chains, the XRP Ledger, Zcash and TRON.

Bitget said the attack path had been identified and fixed. On 30 September it published reports from Mandiant, part of Google Cloud, and the security firm SlowMist; Bitget's summary says both found that third-party security products had been compromised, which gave the attacker access to the exchange's wallet environment. Gracy Chen pointed to North Korea-linked attackers, according to press reports, but Bitget's own notices name no group. Bitget launched a recovery bounty of 5% of any funds frozen or recovered and said some assets had already been frozen with the help of other exchanges and projects, including Bybit's LazarusBounty program.

Withdrawals came back in stages: BTC on 28 September, ETH on 29 September, USDT on 30 September, and other tokens, fiat and peer-to-peer services on 2 October. Bitget later wrote that it completed the restoration plan on 2 October. Bloomberg reported large customer outflows once withdrawals reopened; in the first hour of BTC withdrawals the exchange processed about 4,098 BTC, according to press reports. Our news report on the hack covers the first days in detail.

Bitget's Protection Fund is a reserve the company holds against platform-wide losses. Its page says users whose accounts are compromised or whose assets are stolen or lost through platform-wide events not caused by their own actions may claim on it, and that Bitget assesses each claim. That is narrower than insurance: there is no insurer, and the decision rests with Bitget.

When the hack was announced the fund held over $464 million, by Bitget's account, and Bitget said the loss fell within its coverage. Bitget committed on 28 September to restore the fund to at least $300 million within a week and says it did so on 30 September. On 29 October 2026 the fund page showed a value of $301 million, held as 3,705 BTC and priced daily. Bitget says the fund can be followed through public wallet addresses, but the page as loaded on 29 October did not display an address in its text, so the balance could not be checked on-chain from that page. What exchange protection funds actually cover explains the general limits of such funds.

Bitget publishes a monthly proof of reserves based on a Merkle tree, a structure that lets each customer confirm their balance was included in the total. The snapshot of 21 October 2026 shows a total reserve ratio of 115%, with BTC at 113%, ETH at 162%, USDT at 105%, USDC at 101% and LTC at 110%, among other assets. The page links to the verification code on GitHub and a tool for checking your own balance.

The report is Bitget's own: the page names no accounting firm or security company that reviewed the figures. It also covers only the listed assets at one moment and does not show the company's other liabilities. In July 2026 the reserve table on the same page displayed no data when this site checked it; it is populated now. How to spot a weak proof of reserves explains what such reports can and cannot show.

Bitget publishes a fee schedule by product and VIP level. A regular spot user pays 0.10% as maker and taker, or 0.08% when paying in BGB. Fees fall with 30-day volume, daily balance or BGB holdings; the top VIP tier pays 0% maker and 0.03% taker. On USDT-margined, coin-margined and USDC-margined futures, a regular user pays 0.02% maker and 0.06% taker. Bitget says rates can vary by region and that some coins are excluded during promotions.

Copy trading can add a cost on top of trading fees, because lead traders on copy-trading platforms are usually paid a share of their followers' profits; check the profit-share rate shown on a trader's profile before copying. Past returns on those profiles describe a past period and say nothing about future results.

On 14 July 2026 this site measured an all-in cost of 0.10% for a $10,000 bitcoin market buy on Bitget, with no measurable slippage, and 0.1081% at $100,000. Depth was 93.2 BTC within 0.1% of the best ask and 170.7 BTC within 0.5%, and the API answered in 521 ms. How Bitget compares with other exchanges is covered on its rating card.

Bitget's Terms of Use list its prohibited countries: Austria, Belarus, Canada, Cuba, France, Germany, Hong Kong, Iran, Japan, Kazakhstan, Malaysia, North Korea, Russia, Singapore, Sudan, the United States and its territories, Iraq, Libya, Yemen, Afghanistan, the Central African Republic, the Democratic Republic of the Congo, Guinea-Bissau, Haiti, Lebanon, Somalia, South Sudan, Thailand and occupied regions of Ukraine. Users who reside in or operate from those places are barred. Which exchanges Americans can use covers the alternatives for US residents.

Bitget has no MiCA authorisation and does not appear on ESMA's register of crypto-asset service providers, updated on 22 October 2026. Press reports say a Vienna-based Bitget EU filed for authorisation with Austria's Financial Market Authority and that no decision had been announced by mid-October 2026. Bitget closed its service in France after talks with the AMF: French users' Earn products were terminated and open positions liquidated from late March 2026, and remaining balances were moved to a licensed provider on 31 March 2026.

Elsewhere, Bitget's licence page lists an AUSTRAC registration in Australia, crypto and OTC derivatives licences from South Africa's Financial Sector Conduct Authority, registrations in Argentina, Mexico and El Salvador, an investment dealer licence in Mauritius, a Swiss SRO membership and a licence in the Tbilisi Free Zone in Georgia. In the UK it relies on an FCA-authorised firm to approve its promotions; Bitget itself is not FCA-authorised. Identity verification is mandatory for all users.

A Bitget balance is a claim on BTG Technology Holdings Limited, a company that does not say on its main pages where it is incorporated and holds no licence from a major Western regulator for its core exchange. The September 2026 hack showed the practical meaning: for eight days customers could not withdraw, and the only assurance about their money came from Bitget's own statements and its own fund.

The protection fund is smaller now than before the hack, at about $301 million, and Bitget decides claims on it. The proof of reserves is self-published without an outside reviewer. Bitget's leveraged futures, offered up to 150x on BTC and ETH, can liquidate a position within minutes, and the VOXEL episode in April 2025 showed the exchange will reverse trades it judges abnormal.

Keep on Bitget only what you trade and move the rest to a wallet you control. Bitget Wallet is a separate self-custody app: Bitget cannot freeze funds in it, and the exchange's withdrawal pause did not apply to it, but its security depends on installing it from the official store and guarding the recovery phrase.

Accounts are opened on bitget.com or in the Bitget app, and KYC is required. A regular user's 24-hour withdrawal limit is 3,000,000 USDT, rising with VIP level. To withdraw, pick the coin and network; the fee appears before you confirm. Send a small test amount to any new address, and close futures positions and redeem Earn products before withdrawing the funds behind them.

Bitget's notices about the September incident said users did not need to take any action to regain withdrawals. Any message promising faster withdrawals, compensation or fund recovery in exchange for a fee or your login details is a scam.

Bitget's contact page routes customer service, VIP service, legal, regulatory and law-enforcement requests to separate forms, and the help center offers a feedback form. Bitget publishes a page for verifying official channels and an anti-scam hub, linked from the site footer; check any account, group or website against them before acting.

Bitget's official X account is @bitget. Phishing sites copying the Bitget login page multiply after incidents like the September hack, so sign in from a saved bookmark or the official app rather than a search result.

Dated milestones from Bitget's announcements and press reports:

• 2018: Bitget founded.
• December 2022: BitKeep users lose about $8 million to a fake Android app.
• March 2023: Bitget takes a controlling stake in BitKeep, later renamed Bitget Wallet.
• April 2025: VOXEL futures incident; trades of suspected accounts rolled back.
• March 2026: Service for French users closed; balances moved to a licensed provider.
• 24 September 2026: About $387.5 million stolen from hot and warm wallets; withdrawals paused.
• 30 September 2026: Mandiant and SlowMist reports published; protection fund replenished above $300 million.
• 2 October 2026: Withdrawal restoration completed.
• 20 October 2026: Terms of Use updated, naming BTG Technology Holdings Limited as operator.