No exchange makes your crypto risk-free. Bitget says it replenished its Protection Fund to more than $300 million after reporting a September 2026 incident with a final affected amount of about $388 million. Those disclosures are relevant, but they do not guarantee future access to your assets or eliminate exchange-custody risk.
What happened at Bitget, and how much was affected?
Bitget says it detected unauthorized transfers involving hot wallets at 18:31 UTC on September 24, 2026. Its later incident update describes hot- and warm-wallet involvement. The company first estimated the affected amount at approximately $351.6 million, then reported approximately $388 million as the final verified amount across 12 hot- and warm-wallet addresses. The later figure supersedes the initial estimate; they are not two separate losses. (Bitget Support Center, September 24, 2026; Bitget incident update, September 30, 2026.)
As an Amazon Associate I earn from qualifying purchases.
What Bitget says about the attack
In its September 30 account, Bitget said attackers exploited a vulnerability in a third-party security product to steal internal network credentials. It said the attackers used high-privilege credentials to inject forged withdrawal commands into wallet-related backend systems and bypass risk checks. Bitget also said its private keys were not compromised and cold wallets were unaffected. These are the company’s reported investigation findings, not independently verified technical conclusions.
Free tools Windows power users keep installed
One-click scans. No signup required.
Did Bitget users lose funds?
Bitget said it designated its Protection Fund to cover the incident’s financial impact. Its fund announcement described the fund as separate from reserves backing user balances, and its Proof of Reserves notice said covered assets were fully backed. Those statements do not, on their own, establish that every customer had uninterrupted access during the incident or independently verify every account outcome. Bitget initially said withdrawals were temporarily suspended as a precaution while deposits and trading remained operational.
#1 Best Overall
- Effortlessly build your crypto portfolio via the all in one Ledger Wallet app: buy, sell, send, receive, swap, stake and more across popular blockchains. 15,000+ coins & tokens in a single dashboard. Keep a close eye on the market. Compare service providers. Track performance. Get timely alerts. Build your portfolio with confidence.
- Enjoy Bluetooth connectivity, iOS access, and hours of battery use with this mobile-first, secure backup signer. Freedom you can depend on.
- Genuine Check: confirm your signer is authentic during setup with the Ledger Wallet app.
- Protect your signer: keep it in mint condition at all times with a bespoke Pod or Case to avoid scratches and everyday wear and tear.
Bitget described a phased withdrawal-restoration schedule running from September 28 through October 2, 2026. That schedule is now past, and the company’s timeline and FAQ differed on the ETH resumption date. Check Bitget’s live withdrawal page for the specific asset and network before relying on current availability.
What does Bitget’s $300M+ Protection Fund show?
Bitget says it established the Protection Fund in 2022 with 5,500 BTC and a minimum value of $300 million. On September 30, 2026, it said the fund had been restored to more than $300 million, meeting a one-week replenishment commitment two days after announcing it. The announcement does not substantiate the exact $309 million in the original headline figure.
Bitget said the fund was designated to absorb the approximately $388 million incident impact. CEO Gracy Chen characterized its role in the company’s September 30 press release this way: “The Protection Fund was created for moments like this and absorbed the financial impact of the incident.” That is Bitget’s account of how the fund was used; it is not a promise that every future incident will be covered on the same terms.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Rank #2
- Seedless by design, nothing to steal: Your private key is generated inside the EAL6+ chip and never leaves it. No seed phrase is shown or typed at setup, so a tampered device, keylogger, or phishing site has nothing to capture. 9+ years, millions of card.
- Tap once to manage your entire crypto wallet across 90 blockchains - no USB cables or Bluetooth, no batteries, no setup. Access 16,100+ coins & tokens, DeFi, NFTs, and staking instantly from your phone
- Backup without a seed phrase: Your wallet is copied to 2 backup cards with end-to-end encryption, so there are no words on paper to lose or leak. Keep them in separate places; if one card is lost, the others restore full access. Optional seed phrase for advanced users.
- Engineered to last up to 25 years: Waterproof (IP69K), shockproof and tested for extreme temperatures from −25°C to 50°C. A durable cold wallet with long‑term protection and independently audited security.
- Trusted by 6 million users worldwide - buy, sell, swap, stake, and spend cryptocurrency directly. The secure offline storage wallet designed for how people actually use crypto wallets
A fund balance is one part of assessing an exchange, not a safety score. It does not show by itself how quickly assets could be made available during a future disruption, whether all conditions for a claim would be met, or whether another operational or security failure could occur.
What does an exchange Proof of Reserves prove?
Bitget reported that its September 29, 2026 Proof of Reserves snapshot showed an overall 131% reserve ratio across 19 covered assets. The company’s support notice said user assets were backed 1:1, and its press release said all 19 assets in the snapshot were above the 100% benchmark. These are Bitget-reported figures for that snapshot, not a guarantee about future balances or withdrawals.
Proof of Reserves and a Protection Fund address different questions. A reserves disclosure is meant to show assets against covered user balances; the fund is an additional safeguard Bitget says is separate from those reserves. A ratio alone does not establish that all liabilities are included, that the disclosure amounts to an independent comprehensive audit, or that the exchange’s systems cannot be compromised. When reviewing any exchange’s disclosure, check:
Rank #3
- Dual-chip architecture for maximum protection: The next-gen, fully auditable TROPIC01 chip works alongside a certified EAL6+ Secure Element—completely NDA-free—to deliver radically transparent, industry-leading defense against physical attacks.
- Quantum-ready security: Get protection against future threats with the first-ever hardware wallet designed with quantum-ready architecture.
- See every detail with confidence: Our largest high-resolution color touchscreen makes it easy to navigate your assets, review transactions and manage your coins with clarity.
- Wireless freedom with encrypted Bluetooth control: Manage, buy, swap and stake securely using Trezor Suite on desktop or mobile. Qi2-compatible wireless charging keeps your Trezor powered up. No cables required—security meets convenience.
- Works seamlessly with Android, iOS and desktop: Connect wirelessly or via USB-C to your phone or computer. Manage your crypto anywhere with our companion Trezor Suite app.
- When the snapshot was taken and whether it is current.
- Which assets and customer liabilities are included or excluded.
- How customers can verify inclusion and what independent review, if any, supports the figures.
- Whether a stated protection fund is separate from customer-asset reserves, how it is held, and what terms govern its use.
Is my crypto safe on an exchange?
An exchange can make trading and account recovery more convenient, but it is a third-party custodian: it controls access to the private keys associated with assets held for customers. The SEC Office of Investor Education and Assistance explains that if a custodian is hacked, shuts down, or goes bankrupt, customers may lose access. Exchange disclosures can help you evaluate that risk; they cannot remove it.
The alternative is self-custody, in which you control the keys. That changes who bears the risk rather than making the risk disappear. The SEC’s December 12, 2025 Investor Bulletin notes that lost or stolen keys can cause permanent loss. A hardware wallet can be one way to keep keys offline, but losing the device, exposing the recovery phrase, or making a key-management mistake can still put funds at risk.
| Consideration | Exchange custody | Self-custody |
|---|---|---|
| Who controls key access? | The exchange controls access to the private keys associated with customer holdings. | You control the private keys and are responsible for protecting them. |
| Routine use | Convenient for trading through the exchange; the company operates the account and custody systems. | You manage wallet access and transactions yourself; it is not the same as leaving assets ready to trade in an exchange account. |
| Risks outside your direct control | Exchange compromise, insolvency, or withdrawal suspension can affect access. | There is no exchange custodian controlling your keys, but mistakes or loss of access can be permanent. |
| Recovery responsibility | Account recovery depends on the exchange’s processes and continued operation. | You must safely store and recover your keys or seed phrase; losing them can mean losing access. |
| What to evaluate | Review current reserve disclosures, their scope and verification, and the terms and status of any protection arrangements. | Assess how you will secure and back up keys and recovery information, and how you would regain access if a device were lost or damaged. |
Should you keep crypto on an exchange or move it to a hardware wallet?
Base the choice on how you use the assets and which responsibilities you can manage. Keeping a limited amount on an exchange may suit frequent trading, while assets you do not need for routine exchange activity may be candidates for self-custody if you can protect and recover the keys. This is a trade-off, not a universal rule: dividing holdings also means managing more than one place and access method.
Rank #4
- UNPARALLELED SECURITY: Protect your assets with Trezor Safe 5's NDA-free EAL 6+ Secure Element, offering robust defense and complete transparency.
- EFFORTLESS NAVIGATION: Experience seamless crypto management with the vibrant color touchscreen, designed for intuitive and user-friendly interactions.
- ENHANCED USER EXPERIENCE: Enjoy tactile confirmation with Trezor Touch Haptic Engine, making each interaction precise and engaging.
- SUPPORTS 1000s OF COINS & TOKENS: Securely handle thousands of assets, including Bitcoin, Ethereum, and more, all in one wallet.
- EASY ASSET MANAGEMENT: Monitor and transact seamlessly with Trezor Suite, our user-friendly desktop and mobile app
- If you keep assets with an exchange: use strong, unique account credentials and multifactor authentication, watch for phishing, and review the exchange’s current disclosures and withdrawal status for the assets and networks you use.
- If you choose self-custody: protect the seed phrase offline, never share it or your private keys, and plan for device loss or damage before transferring funds. A physical hardware wallet does not secure a recovery phrase that has been exposed or misplaced.
The SEC’s Investor Bulletin explains that hot wallets are internet-connected and convenient for transactions but more exposed to cyberthreats. Cold wallets are typically physical devices kept offline and generally less exposed to those threats, though a device can be lost, damaged, or stolen. Neither approach removes the need to manage access carefully.
How to judge Bitget’s safety disclosures after the incident
Use the September 2026 incident as a reason to examine both custody arrangements and the quality of current disclosures—not as proof that Bitget is either safe or unsafe in every circumstance. Bitget said Mandiant and SlowMist assisted its investigation and that tracing and recovery efforts remained ongoing. The company also announced a bounty for qualifying recovery leads; no recovered total is established here.
Before deciding whether to leave assets on any exchange, look at the present state of its incident response and withdrawal service, then consider whether you are comfortable with the custody arrangement and its published protections. Bitget’s incident, Protection Fund, and reserve figures are company statements; the SEC’s guidance is general retail education, not a Bitget-specific assessment.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
