For: people who hold or trade crypto assets on Bitget, and anyone who runs security appliances at the edge of a network. This article is based on Bitget's own notices and does not cover attack techniques.
Developing: this article will be updated as the organisation publishes more
As of October 30, 2026Not yet known
- Final amount stolen
- The affected product and vendor
- Whether a vendor fix exists
- Full root-cause report
- Funds frozen or recovered
- Protection Fund level
Bitget said on September 25 that the figures may change as more transactions are traced, and that the vulnerability had been identified and remediated. As of October 30 we found no full post-incident report from Bitget.
What Bitget account holders should do today
Check where you open Bitget from
Use the official app or a bookmark you made yourself. After a large theft, fake pages and messages that imitate the exchange are common. Bitget's notices say updates are posted on its announcement page and official channels, and its "Is Bitget safe?" page says official updates are released only through verified channels, so start there rather than at links sent to you.
Treat any recovery or compensation message as fake
Bitget's "Is Bitget safe?" page says Bitget will never ask users to transfer funds or share passwords, private keys, seed phrases or verification codes, including under the pretext of recovering assets. A message or a stranger offering to "recover" your coins, "verify" your wallet or pay "compensation" is a known scam pattern (see What is phishing?).
Bitget's Recovery Bounty Program pays 5% of funds successfully frozen or recovered to the eligible party whose efforts caused the freeze or recovery. It is aimed at people tracing stolen funds, not at account holders, and Bitget decides eligibility.
Turn on two-factor authentication and set a unique password
Two-factor authentication means a login needs a second code in addition to the password. An authenticator app is preferable to SMS (see the multi-factor authentication guide). A password manager makes a unique password practical.
Check your own balance and history, then decide how much to keep there
Bitget says balances were not affected. You can confirm yours in the app. Decide how much you want to keep on any exchange; assets you do not plan to trade can be held in a wallet you control. That is a general choice for any exchange, not a recommendation to move funds because of this incident.
Ignore messages saying your withdrawal is blocked unless you pay
Withdrawals were paused during the incident and restored in phases. A message now claiming that your withdrawal needs an extra "fee", "unlock" or "verification" payment is not from the exchange.
What happened (per Bitget and press reports of the forensic work)
The facts below come from Bitget's own notices of September 24 and 25 and its public "Is Bitget safe?" page (checked October 30). Where a detail comes from press coverage of forensic findings, it is marked.
August 31, 2026
Earliest malicious activity linked to the incident, according to investigators' log analysis as reported by BleepingComputer.September 24, 2026 (UTC)
At 18:31 UTC, per Bitget's "Is Bitget safe?" page, the attacker initiated the first unauthorized transfer from certain hot and warm wallets. At 19:05 UTC, per Bitget's notice, its reconciliation systems detected the unauthorized transfers. Withdrawals were temporarily suspended as a precaution pending a security review, while deposits and trading continued. Estimated impact: about US$351.6 million.September 25
Bitget confirmed about US$387.5 million sent to attacker-controlled addresses, adding Zcash and TRON assets to its first estimate. It said the vulnerability had been identified and remediated, and launched a Recovery Bounty Program.September 28–30
Bitcoin withdrawals resumed; Bitget scheduled ETH withdrawals for September 29, USDT for September 30, and other tokens, fiat and P2P from October 2 (BleepingComputer). On September 30 Bitget said its Protection Fund was back above US$300 million (as reported by Yellow).October 2
Bitget's page says withdrawals for all cryptocurrencies, fiat currencies and P2P services were fully restored.
- What was taken
- About US$387.5 million in assets from part of the hot and warm wallet layers. Bitget lists XRP, ETH, USDT, ZEC, USDC, USDT0, XAUt, BNB, AVAX and TRX across Ethereum and other EVM networks, XRP Ledger, Zcash and TRON
- Not taken
- Cold wallets were not accessed. Bitget says customer account balances were not affected
- Coverage
- The loss falls within Bitget's User Protection Fund, which Bitget said held over US$464 million on September 24. Its page now cites US$314 million or more
- Cause as disclosed
- Malicious activity involving third-party security products, including a zero-day vulnerability. Bitget says the vulnerability has been identified and remediated and that no further unauthorized transfers are possible
- Investigation
- Forensic help from an incident-response firm and a blockchain security firm, per Bitget. Some assets have been frozen with industry partners
- Contact point
- Bitget's announcement page and official channels; it says official updates are released only through verified channels
Third-party security products: zero-day (Bitget)
↓→
Press reports: access to security appliances
Environment that handles wallet operations
↓→
Press reports: movement into it from the appliances
Withdrawal authorization step
↓→
CEO, as reported: spoofed data triggered it
Hot and warm wallets
↓→
About US$387.5 million sent out; cold wallets not accessed (Bitget)
What is known and what is not
Status as of October 30, 2026. When Bitget publishes more, we will update the status column.
| Item | What Bitget says | Status |
|---|---|---|
| Amount sent to attacker-controlled addresses | About US$387.5 million (first estimate US$351.6 million); may change as tracing continues | Confirmed (Bitget), may change |
| Customer account balances | Not affected | Not affected (Bitget) |
| Cold wallets | Not accessed | Not affected (Bitget) |
| Coverage of the loss | Within the User Protection Fund | Stated (Bitget), not independently audited |
| Protection Fund size | Over US$464 million on September 24; page now cites US$314 million or more and says the fund was replenished above its pre-incident level | Stated (Bitget); the two figures do not match and are not independently verified |
| Entry point | Zero-day vulnerability in third-party security products | Confirmed (Bitget); product and vendor not named |
| Vendor fix | Not stated | Not disclosed |
| Withdrawals | Paused September 24, restored in phases, fully restored October 2 | Confirmed (Bitget's page) |
| Customer personal data | Not listed as affected in the notices | Not listed |
| Full root-cause report | Not published as of October 30 | Under investigation |
| Funds frozen or recovered | Some assets frozen with partners; no total published | Under investigation |
How to read this: 'covered' is a company statement, and the fund figures do not match
The coverage statement and the Protection Fund figures come from Bitget itself and are not independently verified. Bitget says the fund was replenished above its pre-incident level, yet it cites US$314 million or more now against over US$464 million on September 24. We quote both as stated and do not reconcile them. The two times in the timeline are different events: the first unauthorized transfer (18:31 UTC) and its detection (19:05 UTC). If a number matters to you, check Bitget's current page.
What a theft from the exchange's own wallets means for you
In general, a theft from an exchange's own wallets differs from a leak of customer data. Account holders' balances are records inside the exchange, so whether customers lose anything depends on whether the exchange covers the loss. Bitget says it does. Customer personal data is not listed as affected, so the usual follow-on risk is not stolen passwords but scam messages that use the news.
Scam messages commonly follow large thefts: fake "compensation" sites, support impersonators and claims that your funds are frozen. We are not saying any of these has happened here. The steps above are about those scams.
For security teams: what the disclosed facts say
Bitget has said the entry point was a zero-day in third-party security products. Press reports of the forensic findings describe access to security appliances, followed by movement into the environment that handles wallet operations. The product and vendor have not been named, and the full cause has not been published, so we draw only what the disclosed facts support.
The product that guards the network can itself be the way in. Treat security appliances like internet-facing servers: keep a list of them, check which management interfaces are reachable from the internet, apply fixes quickly once a vendor issues them, and watch for unexpected files or outbound connections on the appliance itself. Related guidance: defending VPN and edge devices and edge-device vulnerabilities exploited in October 2026.
Systems that approve money movement need their own checks. Bitget's CEO said, as reported, that data was spoofed to trigger the authorization step. A control that cannot be fed false data by the system next to it, for example an independent confirmation of large withdrawals, limits what one compromised system can do. We do not assess Bitget's own controls.
Sources (public record)
The facts in this article are based on the public information below. We do not speculate on undisclosed techniques or on who was responsible.
- Bitget, security notice on the September 24 hot wallet incident (September 24, 2026) — bitget.com
- Bitget, "Security Latest Incident Update: Fund Tracing and Recovery Bounty Program" (September 25, 2026) — bitget.com
- Bitget, "Is Bitget safe?" incident summary page (checked October 30, 2026) — bitget.com
- BleepingComputer, "Bitget hacked via zero-day in third-party security products" (September 30, 2026) — bleepingcomputer.com
- BleepingComputer, "Bitget resumes Bitcoin withdrawals after $387.5 million crypto heist" (September 28, 2026) — bleepingcomputer.com
- Yellow, "Bitget Restores Protection Fund Above $300M As Withdrawals Resume" (October 1, 2026) — yellow.com
Update history
2026-10-30: First version, based on Bitget's notices of September 24 and 25, its incident summary page (checked October 30) and press coverage of the forensic findings. We will update this article if Bitget publishes a root-cause report, a final figure or the affected vendor's fix.
Read next
- Edge devices as an entry point: Exploited edge-device vulnerabilities, October 2026 / Defending VPN and edge devices
- Accounts: Multi-factor authentication guide / Password manager guide
- Scams: What is phishing?
- Other 2026 incidents: Data breaches and cyberattacks in 2026