No exchange can make crypto risk-free. Bitget says it replenished its Protection Fund to more than $300 million after reporting a September 2026 incident with a final affected amount of about $388 million. That is relevant evidence about how Bitget says it responded—not a guarantee that your funds will always be accessible, that another attack cannot happen, or that exchange custody is safe for every balance. Whether to leave crypto on an exchange or move it to self-custody depends on how you weigh trading convenience against third-party control of your keys.
What happened at Bitget, and how much was affected?
Bitget says it detected unauthorized transfers involving hot wallets at 18:31 UTC on September 24, 2026. Its initial notice put the estimated amount at approximately $351.6 million. A later Bitget incident update gave a final verified affected amount of approximately $388 million across 12 hot- and warm-wallet addresses. The later figure supersedes the initial estimate; they are not two separate losses.
Bitget initially said it temporarily suspended withdrawals as a precaution while deposits and trading remained operational. The company’s September 30 incident page attributes the attack to a vulnerability in a third-party security product that attackers allegedly used to obtain internal network credentials. Bitget says high-privilege credentials were then used to inject forged withdrawal commands into wallet-related backend systems and bypass risk checks. The company also says private keys were not compromised and cold wallets were unaffected. These are Bitget’s reported investigation findings, not independent forensic conclusions.
| Bitget-reported figure | What it represents |
|---|---|
| Approximately $351.6 million | Initial estimate in Bitget’s September 24, 2026 notice. |
| Approximately $388 million | Later final verified affected amount reported by Bitget, involving 12 hot- and warm-wallet addresses. |
Bitget published a phased withdrawal-restoration schedule running from September 28 to October 2, 2026. Its timeline and FAQ gave inconsistent details about when ETH withdrawals would resume, and that schedule has passed. Check Bitget’s live withdrawal page for the specific asset and network you need rather than treating the old schedule as confirmation of current availability.
Recommended Free Tools
#1 Best Overall
Bitget says Mandiant and SlowMist assisted its investigation and that tracing and recovery efforts remained ongoing. It also described a bounty for qualifying recovery leads. The cited incident update does not establish a current amount recovered.
Did Bitget users lose funds?
Bitget said it designated its Protection Fund to cover the incident’s approximately $388 million impact. Its CEO, Gracy Chen, characterized the fund’s role in the company’s September 30 announcement this way: “The Protection Fund was created for moments like this and absorbed the financial impact of the incident.” That is Bitget’s description of its response. The cited disclosures do not independently establish the final outcome for every customer account, so they are not enough to conclude that every user did—or did not—experience a loss or interruption.
Rank #2
- Ideal for Gifting
- Ideal for a bookworm
- Compact for travelling
What does Bitget’s Protection Fund actually show?
Bitget says it established the Protection Fund in 2022 with 5,500 BTC and a minimum value of $300 million. On September 30, 2026, the company said it had restored the fund to more than $300 million, fulfilling a one-week replenishment commitment two days after making it. The announcement does not verify the exact $309 million figure in the original headline.
Bitget says the fund is publicly verifiable on-chain and separate from the reserves backing user balances. A reported fund balance is evidence of a disclosed financial safeguard, but it does not by itself establish the terms under which a future claim would be paid, whether all losses would qualify, or whether withdrawals would remain available during an incident. Those questions depend on the fund’s applicable terms and the circumstances of a future event.
What does Bitget’s Proof of Reserves prove—and what does it not?
In its September 30 announcement, Bitget said a Proof of Reserves snapshot dated September 29, 2026 recorded an overall reserve ratio of 131% — Bitget, 2026 — across 19 covered assets. Bitget’s support notice said user assets were fully backed 1:1, and its announcement said each of the 19 assets in that snapshot was above the 100% benchmark.
Proof of Reserves (PoR) and a Protection Fund address different questions. PoR is meant to show assets relative to covered user balances; the fund is an additional safeguard. A ratio alone does not show that every liability is included, that the disclosure amounts to a comprehensive independent audit, or that the exchange’s systems will always process withdrawals. Nor does either figure rule out operational failures or another compromise of backend systems or third-party products.
Rank #4
- Check the snapshot date: a reserve figure describes a point in time, not necessarily the exchange’s position today.
- Check which assets and user balances are included, and whether the disclosure explains how liabilities are accounted for.
- Look for a way to verify the disclosure independently, and distinguish that evidence from the separate fund balance and its terms.
Is my crypto safe on an exchange?
An exchange account can make buying, selling, and routine trading convenient. But when an exchange custodies your crypto, it controls access to the private keys. The SEC Office of Investor Education and Assistance’s December 12, 2025 Investor Bulletin explains that wallets hold private keys, not the crypto itself, and identifies exchanges as third-party custodians. If a custodian is hacked, shuts down, or goes bankrupt, customers may lose access.
That makes “safe” a matter of risk tolerance and use, not a yes-or-no property of a particular fund balance or PoR ratio. If you keep assets with an exchange, consider what you need for trading and near-term access, what the exchange discloses about reserves and liabilities, and what its applicable custody and protection terms say. Do not treat an exchange’s reported protections as a substitute for considering the possibility of a withdrawal suspension or loss of access.
Best Value
- It can be a gift option
- Comes with secure packaging
- Helpful in various ways
Exchange custody or a hardware wallet: which fits your needs?
| Consideration | Exchange custody | Self-custody with a hardware wallet |
|---|---|---|
| Who controls key access? | The exchange controls access to the private keys for assets it holds in custody. | You control the keys and recovery information. |
| Routine trading | Convenient for frequent trading within the exchange. | Requires managing transfers and your own wallet; it is not the same as leaving trading funds on an exchange. |
| Third-party and platform risk | You depend on the exchange’s systems and continued ability to provide access. | You avoid relying on an exchange to control your keys, but remain exposed to user mistakes and key-security failures. |
| Security responsibility | You must secure your account, including using a strong password and multifactor authentication. | You must protect the device, private keys, and seed phrase. Losing or exposing the recovery information can cause permanent loss. |
| Recovery after loss of access | Account recovery depends on the exchange’s processes and ability to operate. | You need your recovery information; a lost, damaged, or stolen device can create problems if recovery is not safely prepared. |
| Evidence to assess | Review disclosures about reserves, liabilities, protection arrangements, and applicable terms. | Assess your own backup and recovery plan; a device does not remove the need to secure the seed phrase. |
The SEC describes hot wallets as internet-connected and convenient for transactions, but exposed to cyberthreats. Cold wallets are typically physical devices kept offline and generally less exposed to those threats; they can still be lost, damaged, or stolen. A hardware wallet changes who is responsible for key security—it does not guarantee safety.
Quick Recap
Practical steps if you keep crypto on an exchange
- Use a strong, unique account password and multifactor authentication, and remain alert to phishing attempts.
- Review the exchange’s current reserve disclosure for its date, asset coverage, and treatment of liabilities; read the relevant custody and protection terms rather than relying on a headline figure.
- Before relying on access, check the live withdrawal status for the asset and network you plan to use.
Practical steps if you move crypto to self-custody
- Never share your private keys or seed phrase, and store the recovery information securely.
- Plan how you would recover access if the device were lost or damaged; losing the keys or recovery information can result in permanent loss.
- Watch for phishing and verify transaction details before approving a transfer. Moving off an exchange removes one source of custody risk, not the possibility of user error or compromised recovery information.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
