Is Bitget Safe? What the $388M Hack Changed in 2026

Is Bitget safe in 2026?

Yes, with conditions: Bitget says it covered a $388 million hack from its Protection Fund without touching user balances, but that fund is now only just above Bitget's own $300 million floor, Bitget holds no MiCA authorisation, and it pulled back from three countries in 2026.

For a trader, safety comes down to three questions. Can the exchange pay out every balance at once? What happens when something breaks? Can you lose your account for reasons that have nothing to do with your trading? Bitget answers the first with a monthly proof of reserves that it publishes itself, and the September hack was a hard public test of the second. The answer to the third depends on where you live.

What happened in the September 2026 Bitget hack?

Attackers took $388 million from 12 Bitget hot and warm wallet addresses by sending forged withdrawal orders through Bitget's wallet servers, using credentials stolen from an outside security product that Bitget uses.

Bitget's own timeline puts the first unauthorised transfer at 18:31 UTC on 24 September. At 19:05 UTC its reconciliation system flagged the gap and its risk control system blocked withdrawals across the platform. The block did not stop the attacker: the SlowMist investigation records outflows until 21:23 UTC, and Bitget shut down its withdrawal and signing services at 21:44 UTC. Bitget's incident page says the attackers used no common viruses or malware, while Mandiant's status report describes a web shell and malicious packages on the wallet job server.

The estimate grew once. Bitget first put the loss at $351.6 million, then on 25 September raised it to $387.5 million after adding Zcash and TRON assets it had left out. Bitget says the increase came from more complete accounting and that nothing more was stolen. Its final verified figure is $388 million. Bitget also says its investigation ruled out a private key compromise and that cold wallets were not touched. Bitget Wallet runs on separate infrastructure and was not affected.

Two interim reports came out on 30 September, one from Mandiant and one from SlowMist, and they differ on when the intrusion began. Mandiant dates the privileged access to 24 September. SlowMist found malicious activity in the logs as far back as 31 August, more than three weeks before the theft. Neither report names an attacker, and Bitget's incident page says claims about who did it should not be treated as confirmed without verified findings. Bitget's formal security report was still unpublished on 14 October 2026.

Proof of reserves and the Protection Fund after the hack

Bitget's latest proof of reserves, taken five days after the hack, shows a 131% total reserve ratio across 19 coins, and the Protection Fund is back above the $300 million floor Bitget has committed to, by $8 million on 14 October 2026.

The 47th proof of reserves uses a snapshot from 29 September 2026. BTC sits at 142%, ETH at 110%, USDC at 154% and USDT at 107%. The lowest of the 19 covered coins is BNB at 104%, and XRP sits just below USDT. Bitget has published these reports monthly since December 2022 and widened them from 4 to 19 assets on 17 September 2026. You can check that your own balance is in the snapshot with Bitget's open source MerkleValidator tool. A snapshot shows what Bitget reported for that one day, it says nothing about liabilities outside it, and the official pages name no outside auditor.

The Protection Fund started in 2022 with $300 million in BTC. Before the hack Bitget said it held more than $464 million. Bitget used it to cover the $388 million and refilled it to more than $300 million on 30 September. Today it holds 3,705 BTC, which the fund page valued at $308 million on 14 October 2026, so the dollar figure moves with the BTC price. Bitget has not said how much it drew from the fund or where the money to refill it came from. The fund is not insurance: it covers events that hit the whole platform and that you did not cause, and Bitget decides every claim case by case.

Is Bitget regulated, and where can you use it?

Partly: Bitget's licence page lists 9 jurisdictions, but Bitget has no MiCA authorisation in the EU, and its terms exclude residents of the US, Canada, France, Germany, Japan and 24 other countries and regions.

The licence page lists 9 entries. Australia's AUSTRAC registered Bitget, South Africa's FSCA granted a crypto asset licence and an OTC derivatives licence, and Argentina's CNV and El Salvador's central bank and digital asset commission registered it. Mauritius issued an investment dealer licence, and Georgia an authorisation for the Tbilisi Free Zone. Three entries are narrower than they look: in Switzerland Bitget is a member of an industry body that supervises money laundering checks, in Mexico it is registered with the tax office for money laundering checks, and the UK entry only covers financial promotions through an authorised partner.

In the EU, Bitget EU said on 2 July 2026 that it has applied to Austria's FMA for MiCA authorisation, but ESMA's register of authorised providers listed no Bitget company on 7 October 2026. New sign-ups from Germany and France ended on 16 January 2026, and Bitget ended all services for French residents on 31 March after talks with the AMF. In Japan, registrations stopped on 3 August. From 1 November accounts can only close positions, and remaining positions are liquidated on 31 December 2026, while crypto withdrawals stay open throughout. The full list is in our guide to Bitget's restricted countries.

Regulators had warned about Bitget before these exits: Japan's FSA put Bitget on its warning list in March 2023 and November 2024, Malaysia's Securities Commission did so in 2024, and Saskatchewan's FCAA followed in July 2025. The Terms of Use forbid using a VPN to get around a country restriction, and Bitget can close the account of anyone who lives in a prohibited country.

How to keep your Bitget account safe

Switch on Bitget's five free security settings before you deposit, because the Protection Fund pays for attacks on the platform and does not pay for a login you gave away.

Start with a passkey. A passkey only works on official Bitget domains, so it does nothing on a phishing copy of the login page. Bitget's incident page also warns about scams that use the hack as bait: Bitget never asks you to send funds or share passwords, seed phrases or codes to help recover assets. Fake Bitget sites are not new either. In April 2024 Hong Kong's SFC added a platform called Bitget Pro, on two domains that were not bitget.com, to its alert list as suspected of fraud.

One habit matters more than any setting. Keep the margin you trade with on the exchange and move the rest out on a schedule. The September pause showed why: crypto deposits and spot and futures trading kept running, but nothing left the platform for days.

What Bitget costs, and how to pay less

Bitget charges 0.02% maker and 0.06% taker on futures at VIP 0, and 30% cashback through Trade Reclaim brings the net cost to 0.014% and 0.042%.

At 5,000,000 USDT of taker volume a month, the regular rate costs 3,000 USDT in fees, and 900 USDT of that comes back as cashback. Trade Reclaim never holds your funds and needs no API keys, only your Bitget UID, so it adds none of the risks this article covers. Our Bitget fees guide lists the rates for every VIP tier. Put your own volume into the calculator to see your number, and find the setup on the Bitget cashback page.

One limit: cashback is a share of the fee you pay, so as a higher VIP tier lowers Bitget's rates, the USDT you get back shrinks with them.

Regular futures tier, October 2026. Cashback is 30% of the fee, paid in USDT.