Bitget Hack: What Happened, Is Bitget Safe, and Withdrawal Status
Bitget Hack: $388M Stolen What Happened and Is Bitget Safe?
Quick Summary:
The Bitget hack was a security breach on September 24, 2026, in which attackers took about $388 million from the crypto exchange’s hot and warm wallets. Bitget says user balances are intact and that its User Protection Fund will cover the losses. This article explains how the attack worked, what Bitget says is safe, when withdrawals will return, and what the incident means for exchange users.
Key Takeaways
- What happened: On Sept. 24, 2026, an exploit took about $388 million from Bitget’s hot and warm wallets. The first estimate was $351.6 million.
- Scale: It is the largest crypto hack of 2026 so far, bigger than the KelpDAO and Drift Protocol incidents.
- Cause: The attacker used a flaw in a third-party security product to get internal credentials, then sent fake withdrawal commands.
- Safety claim: Bitget says private keys and cold wallets were not affected and user balances are intact.
- Compensation: Losses will be covered by the Bitget User Protection Fund, which holds 5,500 BTC.
- Withdrawals: They are resuming in phases, with everything else due back by Oct. 2.
What Happened in the Bitget Hack
On September 24, 2026, an exploit took roughly $388 million from Bitget’s hot and warm wallets. Bitget’s first public estimate of the loss was $351.6 million. The figure rose to about $388 million as the full damage was counted.
A hot wallet is a wallet connected to the internet, which exchanges use to process everyday withdrawals. A warm wallet sits between hot and cold storage and is used to refill hot wallets. A cold wallet is kept offline and is much harder to attack.
The hack is the largest in crypto so far in 2026. It is bigger than the exploits of KelpDAO and Drift Protocol. Cointelegraph and The Block both reported on the incident and the exchange’s response.
How the Attacker Got In
According to Bitget, the attacker did not break the exchange’s core cryptography. The attacker found a flaw in a third-party security product that Bitget used. That flaw gave the attacker internal credentials, which are the login rights that let systems talk to each other.
With those credentials, the attacker sent fake withdrawal commands. To Bitget’s systems, these commands looked like legitimate requests, so funds moved out of the hot and warm wallets.
A simple comparison helps. Imagine a bank whose vault is never opened, but whose cash-handling desk trusts anyone holding a valid staff badge. The attacker did not crack the vault. They stole a badge through a weak point in a tool the bank relied on, then filled out withdrawal slips. This is why attacks on the tools around an exchange can be as dangerous as attacks on the exchange itself.
Mandiant and SlowMist are investigating. Bitget has not presented the investigation as finished, so more details about the attack may still emerge.
Is Bitget Safe Right Now?
Here is what Bitget says, and it is company-reported information:
- Private keys were not compromised.
- Cold wallets were not affected.
- User balances are intact.
- Losses will be covered by the Bitget User Protection Fund.
These are reassuring claims. If cold storage was untouched, the deepest layer of the exchange’s defenses held. The fact that withdrawals are restarting in stages also suggests Bitget is testing its systems before reopening everything.
Still, no outsider can fully confirm these claims yet. The forensic investigation is ongoing, and a full independent picture may take time. It is also fair to say that the attack exposed a weakness in Bitget’s setup, since a flaw in a third-party product gave the attacker a way in.
So is Bitget safe? Based on what has been reported, user balances are stated to be intact and a compensation fund exists. But the investigation is not complete, and no exchange can be called risk-free. Reasonable users watch official updates and decide how much to keep on any exchange based on their own risk tolerance.
Bitget Withdrawal Status
Bitget is restoring withdrawals in phases rather than all at once. Here is the schedule:
| Asset | Withdrawal Resumption Date |
|---|---|
| Bitcoin (BTC) | Sept. 28, 2026 |
| Ethereum (ETH) | Sept. 29, 2026 |
| Tether (USDT) | Sept. 30, 2026 |
| All other assets | By Oct. 2, 2026 |
According to The Block, each blockchain network must pass security checks before its withdrawals reopen. That explains the step-by-step approach. Reopening one network at a time limits the risk if a problem appears.
Dates can shift if a security check fails, so the safest source for the latest Bitget withdrawal status is the exchange’s official announcement channels. The dates above reflect the schedule reported as of Sept. 29, 2026.
How the Bitget User Protection Fund Works
A user protection fund is a reserve set aside by an exchange to compensate users if a hack or similar event causes losses. It is a safety net that the exchange funds itself.
Bitget says the Bitget User Protection Fund, which holds 5,500 BTC, will cover the losses from this attack. That means Bitget is saying the money to make users whole comes from its own reserve, not from user balances.
Two points are worth understanding:
- The fund is a promise, not a legal guarantee. It works only if the exchange follows through. Users should watch how Bitget handles compensation and communication in the coming days.
- The fund and the stolen amount are different things. The fund is a reserve. The stolen crypto is a separate matter, and recovery efforts (below) try to get some of it back.
Bitget has not said how the fund will be replenished or what happens beyond its statement that losses are covered, so it would be wrong to assume more than that.
Recovery Efforts and the 5% Bounty
Bitget is offering a 5% bounty to anyone who helps freeze or recover the stolen funds. A bounty is a reward paid for useful help, and in crypto it is a common way to encourage security researchers and blockchain analysts to trace stolen assets quickly.
Stolen crypto can move fast across wallets and networks, so speed matters. If funds are frozen before the attacker can cash out, recovery becomes possible. Mandiant and SlowMist are part of the investigation, and their work may help identify where the money went.
It is important to stay realistic. Recovery is not guaranteed, and no amount has been confirmed as recovered in the facts available. The User Protection Fund exists precisely because getting the stolen money back is uncertain.
Why This Hack Matters
This incident matters beyond Bitget for three reasons.
First, it is the largest crypto hack of 2026 so far. Hacks of this size shake confidence in centralized exchanges, which hold user funds on their behalf.
Second, the entry point was a third-party tool. Many exchanges depend on outside security vendors. If one such product has a flaw, it can become a doorway into an exchange’s internal systems. The lesson for the industry is that security is only as strong as the weakest connected tool.
Third, it shows why wallet design matters. Bitget says cold wallets were untouched. The stolen funds came from hot and warm wallets, which are more exposed because they must stay connected to process withdrawals. Keeping most assets in cold storage limits the damage of an attack like this, though it cannot prevent every loss.
What Users Can Do
None of this is financial advice, but some general habits apply to any exchange user:
- Follow official channels only. After a hack, scammers often send fake “recovery” or “verification” messages. Do not click links from unknown senders or share passwords or codes.
- Turn on strong account protection. Use two-factor authentication and, where offered, withdrawal whitelists.
- Do not panic-move funds without checking. Confirm the current withdrawal schedule before making decisions.
- Consider how much you keep on any exchange. Assets held on an exchange depend on that exchange’s security. Some users prefer to hold long-term funds in their own wallets.
- Wait for the investigation. More details from Mandiant and SlowMist could change the picture.
- At CST Times, we follow our Security & Guides approach to share simple, practical steps that can help users keep their crypto accounts and funds safer.
Final Thoughts:
The Bitget hack was a serious event, with about $388 million drained on Sept. 24, 2026. The reported facts so far are reassuring on the key points: Bitget says private keys and cold wallets were safe, user balances are intact, and the User Protection Fund will cover the losses. Phased withdrawals are already underway.
The facts also carry limits. Most of the reassurance comes from Bitget itself, and the investigation is still open. Anyone using a crypto exchange should treat this as a reminder that even large platforms carry risk. Follow official updates as the story develops.
What Is the Biggest Risks in Crypto? (Professional Report-Based Analysis)
How to Create a 100% Secure Binance Account in 2026
What is the CLARITY Act? The US Crypto Bill That Could Decide Who Regulates Digital Assets
What is Market Risk? Types, Factors, and Examples
Systematic vs Unsystematic Risk: What’s the Difference and Why It Matters
What is Liquidity Risk? Types, Examples & How to Manage It
FAQs
What was the Bitget hack?
The Bitget hack was an exploit on Sept. 24, 2026, that drained about $388 million from Bitget’s hot and warm wallets. The first estimate was $351.6 million.
How did the Bitget hack happen?
The attacker used a flaw in a third-party security product to get internal credentials. They then sent fake withdrawal commands that moved funds out of Bitget’s wallets.
Is Bitget safe?
Bitget says private keys and cold wallets were not affected and that user balances are intact. The investigation is still ongoing, so the full picture is not yet independently confirmed. No exchange is completely risk-free.
Will users lose money from the Bitget hack?
Bitget says losses will be covered by the Bitget User Protection Fund, which holds 5,500 BTC. Users should follow Bitget’s official updates for details.
Disclaimer
This article is for information only and is not financial or investment advice. Cryptocurrency carries significant risk, including the risk of losing funds on exchanges. Details in breaking news can change, so confirm current information with official Bitget announcements.
Follow us on Social media :
About The Author
Pingback: Crypto Mining vs Crypto Staking: Costs, Risks (Oct 2026)