In this article · 8 sections
Bitget says no customer balance was touched: the theft was covered by the exchange's own Protection Fund, and withdrawals reopened in stages between 28 September and 2 October 2026. That answers the short-term question. The longer one is less comfortable. Attackers obtained internal credentials through a flaw in third-party software and moved about $387.5 million out of hot and warm wallets, the largest crypto theft of 2026 so far. Bitget is not authorised under the EU's MiCA rules. We do not review Bitget, do not rank it, and earn nothing if you use it or leave it.
The short answer
Is your money at Bitget gone? On the evidence published so far, no. Bitget says customer balances were unaffected and the loss was absorbed by its Protection Fund. Is Bitget a platform we would pick to hold savings? Also no. The breach showed that internal credentials could be turned into withdrawal orders that passed the exchange's risk controls, and in the EU Bitget has no MiCA authorisation. Use any exchange to trade, keep long-term holdings in a wallet you control, and if you are in the EU, choose a platform listed on ESMA's register.
What happened: the timeline
All figures are Bitget's own, as reported by the outlets cited. The increase from $351.6 million to $387.5 million came from Zcash and Tron transfers identified later; Bitget describes it as a more complete count, not a second theft.
| Date | Event |
|---|---|
| 24 Sep, 18:31 | Unauthorised transfers detected from a limited number of hot and warm wallets; withdrawals suspended. First estimate: $351.6 million |
| 25 Sep | Estimate raised to about $387.5 million after additional Zcash and Tron transfers are identified |
| 28 Sep | CEO Gracy Chen says attackers exploited vulnerabilities in third-party products to obtain internal credentials, then issued fraudulent withdrawal commands. Private keys and cold wallets not affected. Bitcoin withdrawals reopen at 08:00 |
| 29 Sep | ETH withdrawals reopen (Ethereum, BNB Chain, Arbitrum, Base, Optimism) |
| 30 Sep | USDT withdrawals reopen (Ethereum, BNB Chain, Solana, Tron) |
| 2 Oct | Remaining tokens, fiat and P2P withdrawals scheduled to reopen. Chen tells CNBC that about $1.1 million has been frozen and Bitget does not expect to recover much |
Sources: BleepingComputer, 28 Sep 2026 · Crypto Briefing, 28 Sep 2026 · CNBC, 2 Oct 2026
Who did it
Bitget's chief executive blamed North Korean hackers, citing on-chain analysis and IP patterns. That is the company's suspicion, not a finding by a government agency. Mandiant and SlowMist are working on the investigation. The pattern fits other large 2026 thefts attributed to North Korean groups, which tend to go after people, credentials and suppliers rather than smart-contract code.
The Protection Fund, in plain numbers
Bitget's Protection Fund held more than $464 million when the breach was disclosed. Covering the whole $387.5 million would use about 84% of it, as Finance Magnates calculated. One outlet reported that the fund fell below $200 million in the days after the breach; we have not seen that figure independently confirmed. On 28 September Bitget committed to bring the fund back to at least $300 million within a week, and on 30 September it said this was done, from its own capital.
Understand what this fund is. It is money set aside and held by Bitget itself, not an insurance policy from a third party. It worked this time because the loss fitted inside it. A larger loss, or one that coincided with a market crash and mass withdrawals, would test it differently. That is not a prediction; it is the reason we tell readers not to treat any exchange as a vault.
Sources: Crypto Briefing, 28 Sep 2026 (fund above $464M) · Finance Magnates (84% of the fund) · Bitget announcement, 30 Sep 2026 (fund back above $300M)
Get the Exchange Safety Checklist
Plus an alert whenever a top exchange changes its proof-of-reserves, licensing or security status. No spam, unsubscribe anytime.
We store only your email to send the checklist and safety alerts. See our privacy policy.
Where Bitget stands with regulators
European Union: ESMA's interim MiCA register lists every authorised crypto-asset service provider. In the version updated on 7 October 2026, no Bitget entity appears. Bitget's EU entity has applied to Austria's Financial Market Authority, according to register trackers; an application is not an authorisation.
France: the AMF blacklisted Bitget on 7 November 2023 for offering services without registration. The AMF's notice now states that bitget.com was removed from its blacklist on 9 July 2026. Removal from a blacklist is not a licence, and since 1 July 2026 only MiCA-authorised providers may serve French residents.
Sources: ESMA interim MiCA register (CASP file, updated 7 Oct 2026) · AMF notice on Bitget (blacklisting 2023, removal 9 Jul 2026) · CASP Tracker: Bitget
Bitget in September's numbers
September 2026 was the worst month of the year for crypto thefts. CertiK counted $766.4 million in gross losses in its first tally on 30 September, later reported at $768.4 million; PeckShield counted $766.5 million. Bitget alone accounts for about half of it, the rest mostly from the Liquid Network incident on 6 September, where most of the stolen bitcoin was later returned. The month-by-month detail is in our hacks tracker.
Sources: crypto.news, 1 Oct 2026 (CertiK, PeckShield) · The Crypto Times, 30 Sep 2026 (CertiK tally)
Watch out for fake 'Bitget compensation' messages
Large hacks are followed by a second wave: messages offering a refund, a 'compensation claim', an airdrop for affected users or a 'wallet verification'. Bitget says customer balances were not affected, so there is nothing to claim. Treat any such link, DM, email or search ad as phishing, and never enter a recovery phrase or exchange password on a page you reached from a message.
What we would do if we had funds on Bitget
No panic, no rush through unfamiliar links. Log in by typing the address yourself, test a small withdrawal to an address you control, and once it lands, decide calmly what to keep there. Anything you are not actively trading belongs in self-custody. If you are in the EU and want a regulated platform, check the entity on ESMA's register before you sign up.
Next step
Keep savings off every exchange
The lesson from 2026's biggest theft is the old one: an exchange is for trading, not storage. A hardware wallet bought from the manufacturer keeps the keys with you.
Sponsored · affiliate link. We may earn a commission; it never changes our rankings or this article.
Keep reading
Quick answers
Did Bitget users lose money in the hack?
According to Bitget, no. It says customer account balances were unaffected and the $387.5 million loss was covered by its own Protection Fund. That is the company's statement; no independent audit of balances has been published.
Are Bitget withdrawals working?
Bitget reopened withdrawals in stages: bitcoin on 28 September, ETH on 29 September, USDT on 30 September, and the remaining tokens, fiat and P2P from 2 October 2026. Test with a small amount first.
Is Bitget licensed under MiCA?
No. No Bitget entity appears in ESMA's interim MiCA register as updated on 7 October 2026. An application with Austria's regulator has been reported; that is not an authorisation.
Does CoinVetted earn money from Bitget?
No. We have no affiliate or commercial relationship with Bitget and do not include it in our rankings.