iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
No exchange can make crypto risk-free. Bitget says it restored its Protection Fund to more than $300 million after a September 2026 incident it later put at approximately $388 million. That disclosure is relevant, but it does not guarantee future withdrawals, prevent another attack, or remove the risks of letting a company control access to your crypto. The practical choice is between exchange convenience and third-party risk, or self-custody control and your own responsibility for protecting the keys.
What happened at Bitget, and how much was affected?
Bitget says it detected unauthorized transfers involving hot wallets at 18:31 UTC on September 24, 2026. Its initial notice estimated the affected amount at approximately $351.6 million. A later Bitget incident update gave a final verified amount of approximately $388 million across 12 hot- and warm-wallet addresses. The later figure supersedes the initial estimate; these are not two separate reported losses.
Bitget says attackers exploited a vulnerability in a third-party security product to steal internal network credentials, then used high-privilege credentials to inject forged withdrawal commands into wallet-related backend systems and bypass risk checks. Bitget’s investigation says private keys were not compromised and cold wallets were unaffected. These are the company’s account of the incident, not independently verified forensic conclusions.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsBitget initially said it temporarily suspended withdrawals as a precaution while deposits and trading remained operational. Its planned withdrawal-restoration schedule ran from September 28 through October 2, but that schedule is now past and Bitget’s timeline and FAQ gave inconsistent ETH dates. Check Bitget’s current withdrawal status for the specific asset and network rather than relying on the old schedule. Bitget said Mandiant and SlowMist assisted its investigation and that tracing and recovery work remained underway; no current recovered total is established here.
#1 Best Overall
What does Bitget’s $300 million-plus Protection Fund show?
Bitget says it established the Protection Fund in 2022 with 5,500 BTC and a minimum value of $300 million. In its September 30, 2026 announcement, the company said it had designated the fund to cover the incident’s approximately $388 million impact and restored the fund to more than $300 million, two days after making a one-week replenishment commitment. The announcement does not verify the $309 million figure in the original headline.
Bitget CEO Gracy Chen characterized the fund’s role this way in the September 30 announcement: “The Protection Fund was created for moments like this and absorbed the financial impact of the incident.” This is Bitget’s description of how it handled this event. It does not establish that the fund will cover every future loss, that users have a guaranteed claim on it, or that withdrawals will always be available. Bitget says the fund is publicly verifiable on-chain and separate from reserves backing customer balances; readers should assess the fund and its terms separately from reserve disclosures.
What does Proof of Reserves prove—and what does it not?
Bitget’s September 30 announcement reported a 131% overall reserve ratio in a Proof of Reserves snapshot dated September 29, 2026, covering 19 assets. Bitget’s support notice said user assets were fully backed 1:1, and its announcement said all 19 covered assets were above the 100% benchmark. These are Bitget-reported figures for that snapshot, not a promise about a later date or every asset on the platform.
Proof of Reserves and a Protection Fund answer different questions: the former is meant to show assets against covered user balances; the latter is an additional financial safeguard. Neither figure by itself demonstrates that all liabilities are included in a comprehensive independent audit, that the platform’s systems cannot be compromised, or that customers can withdraw whenever they want. When reading a reserve disclosure, ask:
- How recent is the snapshot, and which assets and user balances does it cover?
- Can the evidence be independently checked, and does it account for liabilities as well as assets?
- Is the protection fund distinct from customer reserves, and what do the applicable terms say about its use?
- What is the current withdrawal status for the asset and network you need?
Is my crypto safe on an exchange?
An exchange account may be convenient, but it is a custodial arrangement: a third party controls access to the private keys associated with your crypto. The SEC Office of Investor Education and Assistance’s December 12, 2025 Investor Bulletin explains that a custodian such as an exchange can be hacked, shut down, or go bankrupt, potentially leaving customers unable to access assets. A reserve ratio or protection fund can be useful evidence to consider, but neither changes who controls access.
Bitget’s incident illustrates why reserve backing and operational security are separate issues. The company says the attack used compromised internal credentials and forged backend withdrawal commands, while its private keys remained uncompromised. Even if those findings are accurate, they do not demonstrate that another attack path is impossible or that every exchange risk has been removed.
Exchange custody vs. self-custody
| Consideration | Exchange custody | Self-custody |
|---|---|---|
| Who controls key access? | The exchange or other custodian controls access to customers’ private keys. | You control the private keys and must protect them. |
| Routine trading | Convenient when you want assets available in an exchange account for trading. | Moving assets to and from a wallet adds steps; the SEC describes hot wallets as convenient for transactions. |
| Platform or account risk | You may lose access if the custodian is hacked, shuts down, goes bankrupt, or suspends withdrawals. | You are less dependent on an exchange for key access, but still face risks from mistakes, theft, or loss of keys. |
| Recovery responsibility | Access depends on the provider’s account controls and applicable processes; check its terms. | You must keep recovery information safe. Lost or stolen keys can mean permanent loss. |
| Online exposure | Exchange accounts and connected systems are exposed to online threats. | A hot wallet is internet-connected; a cold wallet is typically kept offline and generally less exposed to cyberthreats. A physical device can still be lost, damaged, or stolen. |
| What to examine | Review the provider’s current reserve disclosures, withdrawal status, protection arrangements, and applicable terms. | Assess whether you can securely store keys and recovery information and maintain access over time. |
The SEC bulletin explains that wallets hold private keys, not the crypto assets themselves. A generic hardware crypto wallet is one option for people who choose self-custody; it is not a fix for an exchange hack and cannot protect against a lost device, exposed recovery phrase, or user error.
Recommended Free Tools
How to decide what to keep on an exchange
- Keep only what needs exchange access there. If you need funds available for trading, convenience may justify keeping some assets with a custodian. Treat that as accepting counterparty and access risk, not as proof the account is risk-free.
- Check current, asset-specific information. Before relying on Bitget or another exchange, review the live withdrawal status for the asset and network, the latest reserve disclosure, and the terms for any protection arrangement. A dated snapshot describes a point in time.
- Consider self-custody only if you can manage it. With a hardware or other self-custody wallet, protect the seed phrase and private keys, keep recovery information secure, and confirm you understand how recovery works before transferring a significant amount.
- Secure every online account you use. The SEC recommends strong passwords and multifactor authentication for online accounts, watching for phishing, and never sharing private keys or seed phrases.
For an exchange user asking whether Bitget is safe after the hack, the evidence supports neither a blanket assurance nor a claim that all users lost funds. Bitget says its fund absorbed the incident’s financial impact, but the company statements summarized here do not establish individual customer outcomes or guarantee future access. Decide based on your need for exchange functionality, your tolerance for custodian risk, and your ability to safeguard keys yourself.
Quick Recap
Best Value
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
