Bitget Security Incident (Hacking Attack) — Official Progress Update
Yes—Bitget was hacked on September 24, 2026. At 18:31 UTC that day, the attacker initiated the first unauthorized transfers from certain hot wallets and warm wallets; at 19:05 UTC, Bitget's reconciliation system detected anomalies, and the risk control system immediately and automatically blocked withdrawal requests across the platform. The investigation found that the attacker exploited a vulnerability in a third-party security product to steal internal network access credentials, forged withdrawal instructions, and bypassed risk controls to complete the transfers. Private keys were not compromised, and cold wallets were unaffected. Withdrawal services were fully restored on October 2, and independent investigation reports from Mandiant and SlowMist have been released. This page continuously consolidates verified facts, the root cause of the attack, withdrawal recovery progress, and the latest developments in the investigation and asset recovery.
Last updated: 2026-10-13 00:00 UTC · Incident date: 2026-09-24
View full timeline
Estimated affected funds
$388M
Final verified figure · Involving 12 wallet addresses
Withdrawal status
Fully restored
BTC September 28 · ETH September 29 · USDT September 30 · Others October 2
Cold wallet/private key
Unaffected
Securely held in a three-layer wallet architecture
Protection Fund
$314 million+
Holding 3705 BTC · Replenished to over $300M as committed
Bitget Hack Incident Timeline: Confirmed Facts in Chronological Order
Each record below links back to the original official announcement. Historical entries will not be retroactively modified—any corrections will be appended as new entries.
2026-10-02 · 08:00 UTC
2026-09-30 · 08:00 UTC
USDT withdrawals restored; independent investigation reports from Mandiant and SlowMist released; Protection Fund replenished to $300M+
USDT withdrawals (Ethereum, BSC, Solana, Tron) have been restored as planned. View the official withdrawal recovery announcement →
Mandiant (a Google Cloud company) and SlowMist released independent investigation reports. Their findings are broadly consistent with the previously disclosed attack path, confirming that the compromise of a third-party security product led to unauthorized access to the wallet environment.
On September 28, we committed to replenishing the Bitget Protection Fund to at least $300M within one week. The Bitget Protection Fund has now been replenished to over $300M. Users can visit the Bitget Protection Fund page to view the relevant wallet addresses and independently verify the on-chain funds.
2026-09-29 · 08:00 UTC
ETH withdrawals resume, Bitget updates Proof of Reserves: latest total reserve ratio: 131%
Withdrawals for ETH and its EVM networks (Ethereum, BSC, Arbitrum, Base, Optimism) have resumed as scheduled. View the official withdrawal resumption plan →
Bitget has released the 47th Proof of Reserves update, announcing the latest reserve ratio covering a total of 19 assets.
Meanwhile, Bitget is launching limited-time high-yield flexible Earn for USDT/USDGO, limited-time rate hikes for USDGO HodlerYield, and ETH and BTC PoolX airdrop reward activities. Join the activity now →
Security Incident Details
Bitget Hacking Incident: Overview
On September 24, 2026, at 18:31 UTC, the attacker initiated the first unauthorized transfers from certain hot wallets and warm wallets. At 19:05 UTC, Bitget's reconciliation system detected a discrepancy in fund verification, and the risk control system immediately and automatically intercepted withdrawal requests across the platform. This was the first security incident of its kind in Bitget's 8 years of operation. The incident has been contained—no further unauthorized transfers will occur. Cold wallets holding the majority of platform assets were unaffected, and no private keys were compromised.
The affected assets involve 11 chains (Ethereum, XRP Ledger, Zcash, TRON, Arbitrum, Optimism, Base, BSC, Avalanche, Algorand, Celestia) and 12 assets (XRP, ETH, USDT, ZEC, USDC, USDT0, XAUt, BNB, AVAX, TRX, ALGO, TIA). Bitget has identified the attack path and remediated the relevant vulnerabilities.
Independent investigation reports from Mandiant (a Google Cloud company) and SlowMist were released on September 30. Their conclusions are broadly consistent with the previously disclosed attack path: both confirmed that a third-party security product was compromised, ultimately allowing the attacker to gain unauthorized access to Bitget's exchange wallet environment. No new unauthorized transfers were identified after containment was completed. Fund tracking, asset recovery, and longer-term security upgrades remain ongoing.
Root Cause of the Attack: How Did It Happen?
Following a comprehensive investigation, Bitget has confirmed the full attack chain. The attackers did not use common viruses or malware. Instead, they impersonated legitimate identities and relied on routine operational procedures throughout, making this a highly sophisticated targeted attack.
Key findings: Private keys were not compromised, and cold wallets were unaffected. Bitget has completed vulnerability remediation, reset all internal credentials and tightened access to highly sensitive permissions, notified the third-party vendor and disabled the related functionality, and strengthened independent withdrawal verification. A formal security report will be released shortly, disclosing more complete technical details.
Steal internal network credentials and infiltrate internal systems
A third-party security product used by Bitget contained a zero-day vulnerability, which the attackers exploited to infiltrate the platform's critical internal management systems. Because the impersonated identity information was genuine and valid, the system recognized the access as a normal user login.
Forge withdrawal instructions and bypass risk controls
The attackers used stolen high-privilege credentials to access wallet-related backend servers and directly wrote forged withdrawal commands into the wallet system, causing the system to process them as normal withdrawals. This bypassed the risk-control verification process before withdrawal records were generated and enabled the transfer of funds from hot/warm wallets.
Erase traces and make tracing more difficult
Fund Tracking and Asset Recovery Bounty Program
Independent cybersecurity firms Mandiant and SlowMist are assisting with the investigation. Real-time on-chain tracking data has been made public.
Asset Recovery Bounty Program
Eligible individuals or organizations whose voluntary assistance directly results in the freezing or recovery of funds may receive a bounty equal to 5% of the frozen amount or 5% of the recovered amount. Bitget also regards Bybit's LazarusBounty program as one of its core collaboration channels for asset recovery.
Phased Withdrawal Service Resumption Schedule
This suspension is a precautionary security measure and does not mean that funds are unavailable. Trading and deposit services remain fully operational.
This phased approach enables Bitget to restore withdrawal services in an orderly manner following the incident. This plan applies uniformly to all users, with no priority given to any user. Our goal is to restore withdrawal services for all supported assets and networks as quickly and securely as possible.
Frequently Asked Questions
What exactly happened in the Bitget hot wallet security incident? Was Bitget really hacked?
The attacker exploited a zero-day vulnerability in a third-party security product used by Bitget to breach the internal key management system and steal high-privilege credentials. They then used these credentials to write forged withdrawal commands to the wallet system, causing the system to process them as normal withdrawals, thereby bypassing risk control verifications to complete the fund transfers. After the transfers were completed, the attacker also deleted the operation traces. The entire process did not use common viruses or malware; it was a highly technical targeted attack. Private keys were not compromised, and cold wallets were unaffected. The relevant vulnerability has been fixed, and the third-party vendor has been notified and assisted in the remediation.
How did the attacker breach Bitget?
The attacker exploited a zero-day vulnerability in a third-party security product used by Bitget to gain access to critical internal management systems and steal high-privilege credentials. The attacker then used those credentials to write forged withdrawal instructions to the wallet system, causing the system to process them as normal withdrawals and bypass risk-control checks to transfer funds. After the transfers were completed, the attacker also deleted traces of the activity. No common viruses or malware were used during the attack; it was a technically sophisticated targeted attack. Private keys were not compromised, and cold wallets were not affected. The vulnerability has been fixed, and the third-party vendor has been notified and is assisting with remediation.
How much did Bitget lose in this security incident?
Following final verification, approximately $388M in assets was transferred out, involving 12 wallet addresses, all of which were hot wallets and warm wallets. This figure reflects the latest accounting and classification results for onchain transactions related to this incident.
Why did Bitget suspend withdrawals after this security incident?
The suspension is a preventive security measure used to complete the final verification of the withdrawal infrastructure before safely resuming services—it is unrelated to the availability of user assets. Deposit and trading services remained operating normally throughout the incident.
Are withdrawals currently available? What is the recovery progress for each asset?
BTC withdrawals resumed as scheduled on September 28; ETH withdrawals will resume on September 29; USDT will resume on September 30; and other cryptocurrencies, fiat currencies, and P2P services are expected to fully resume on October 2. Please refer to the withdrawal recovery schedule above for details.
Which assets can be withdrawn first following this Bitget security incident? Is the withdrawal order related to my account tier?
The recovery order is determined by asset type and is unrelated to account tier: BTC first (September 28), followed by ETH and its EVM networks (September 29), then USDT across all supported networks (September 30), and finally other cryptocurrencies, fiat currencies, and P2P (October 2). This schedule applies equally to all users; there is no VIP or account-tier priority.
Which cryptos can be withdrawn first after this Bitget security incident? Is the withdrawal order related to my account tier?
The recovery order is determined by asset type and is unrelated to account tier: BTC first (September 28), followed by ETH and its EVM networks (September 29), then USDT across all supported networks (September 30), and finally other cryptocurrencies, fiat currencies, and P2P (October 2). This schedule applies equally to all users; there is no VIP or account-tier priority.
Are my funds still safe after this Bitget security incident?
Yes. Your account balance is accurate and unaffected. The financial impact of this incident is covered by the Bitget Protection Fund, which holds 5500 BTC, valued at over $464 million. The cold wallets holding the majority of the platform's assets were not breached.
Were there any user fund losses in this Bitget security incident, or only the platform's own funds?
User account balances remain accurate and unaffected. The approximately $388M affected in this incident came from hot wallet and warm wallet infrastructure. Any resulting financial impact will be covered by the Bitget Protection Fund and will not be passed on to user account balances.
Can Bitget remain solvent after losing approximately $388M?
The Bitget Protection Fund holds 5,500 BTC (over $464M)—more than the current estimated $388M in affected funds—and has been designated to cover the full financial impact of this platform-level incident. Cold wallets, which hold the majority of platform assets, were not affected by this incident. Bitget's latest financial report as of August 31 shows that its own funds, including the Protection Fund, exceed $1.4B.
Can Bitget's Protection Fund really cover this security incident? How can I verify it?
Yes—Bitget has stated that the Protection Fund (holding 5500 BTC, worth over $464 million) covers the financial impact of this incident. For independent verification, it is recommended to cross-check Bitget's self-published monthly Proof of Reserves (comprehensive reserve ratio of 127%, Merkle Tree proof, and reserve ratio), as well as the official announcements on incident progress linked in the timeline above, rather than relying solely on the summary on this page.
Are the reserves still sufficient after the incident? What is the comprehensive reserve ratio?
Bitget's latest Proof of Reserves shows a combined reserve ratio of 127%. Updated reserve information will be published once the independent forensic review is complete.
Is Bitget still safe to use after this security incident? Do I need to transfer my funds out?
Deposit and trading services remained operating normally throughout the incident, account balances were unaffected, and this breach was strictly limited to the hot wallet/warm wallet infrastructure; cold wallets were untouched, and private keys were not compromised. Whether to continue holding funds on any exchange is a personal risk decision—this page provides verified facts (timeline, root cause of the attack, Protection Fund, Proof of Reserves) for you to make your own judgment based on the latest information, rather than hearsay.
Is this the first time Bitget has been hacked?
Yes. This is the first security incident of this kind in Bitget's 8-year operating history. It was a targeted attack on the supply chain of third-party security software, rather than a failure of Bitget's core underlying architecture or private key management—cold wallets were not affected, and private keys were not compromised. Upon detecting the anomaly, Bitget activated its highest-level emergency response within minutes and swiftly contained the losses. It is currently conducting an independent review jointly with Mandiant and SlowMist, and will comprehensively upgrade its monitoring and management standards for third-party components.
Have any users successfully withdrawn funds following this Bitget security incident?
Yes, BTC and ETH withdrawals resumed as scheduled on September 28 and September 29, respectively, and a large number of users have successfully completed withdrawals since the resumption (as of September 28 at 09:00 UTC, 9585 BTC transactions have been processed, totaling approximately 4098 BTC). USDT and other assets will gradually resume according to the schedule.
How can I verify Bitget's Proof of Reserves after the security incident?
Bitget self-publishes a cryptographic Merkle Tree-based Proof of Reserves and reserve ratio every month—see the link in the "Fund Security Guarantee" module above. It is recommended to cross-check the published PoR figures with the Protection Fund balance and the confirmed transferred amounts on this page to independently verify the data, rather than relying on a single source of information.
How much in funds has been frozen or recovered since this Bitget security incident?
Asset recovery efforts are ongoing, and some affected assets have been successfully frozen through collaboration with exchanges, blockchain projects, and security firms. For real-time data, please refer to the Bitget real-time tracking dashboard linked above. Specific figures are not repeated on this page because the amounts frozen and recovered continue to change as the investigation progresses.
What are the Bitget Alliance Program and Project Stand Together?
These are two limited-time user reward programs launched simultaneously by Bitget: the Bitget Alliance Program for retail users, which sets 30% of the actual retained net transaction fees of non-institutional users as an exclusive promotion pool to reward users, and introduces a VIP tier maintenance plan; and Project Stand Together for PRO clients and market makers, which provides rewards in terms of transaction fees and rebates, and extends PRO tier protection until November 30. Please refer to the official announcement for the complete rules.
What is Bitget's latest official update on this security incident?
The latest entry in the verified timeline above always represents the latest official progress. As of the last update of this page, the latest progress is that BTC withdrawals resumed as scheduled on September 28. It is recommended to bookmark this page or follow the official X account @Bitget to get the latest confirmed information.
Is Bitget regulated? Does it hold any licenses?
Yes, Bitget holds regulatory licenses and registrations issued by multiple jurisdictions and operates in accordance with relevant regulatory requirements. This security incident is unrelated to the platform's regulatory compliance status—the incident stemmed from the exploitation of a vulnerability in a third-party security product, not an issue at the platform qualification or licensing level. Specific license information can be viewed on the official compliance page.
Has the vulnerability that led to this hack been fixed?
Yes. Bitget has confirmed the attack path and remediated the exploited vulnerability in the third-party security product. It has also reset all internal credentials, tightened high-sensitivity permissions, notified the third-party vendor and disabled the relevant functions, and strengthened independent withdrawal verification mechanisms. No further unauthorized transfers have been identified since containment was completed. Independent investigation reports from Mandiant and SlowMist have also confirmed that the attack path is consistent with Bitget's official disclosure.
Has my account balance been affected by this incident?
No. The approximately $388M in affected funds in this incident came from hot wallet and warm wallet infrastructure and did not involve any user account balances. Your account balance remained accurate and unaffected throughout the incident. The resulting financial impact will be covered by the Bitget Protection Fund and will not be passed on to user accounts.
Is this Bitget incident now completely over?
Yes. The phased withdrawal resumption plan was fully completed on October 2 (BTC→ETH→USDT→other cryptos/fiat/P2P resumed in sequence), the exploited vulnerability has been fixed, independent investigation reports by Mandiant and SlowMist have been published, and no new unauthorized transfers have been detected since containment. Fund tracking and recovery efforts are still ongoing, but the emergency response and recovery processes at the platform level have been completed.
Stay Updated on the Latest Developments
This page will be continuously updated as official information is confirmed. If you have any account-related questions, please contact customer support directly.
Beware of Scams Exploiting This Incident
Bitget will never ask users to transfer funds or disclose passwords, private keys, seed phrases, or verification codes under the pretext of “assisting with asset recovery” or “restoring withdrawals.” Please obtain information only through the official channels and links published on this page.