Incident tracker
Bitget Hack (Sep 2026): Timeline and Withdrawal Status
Bitget's 24 Sep 2026 security incident from its official notice: approx. $388M, timeline in UTC, withdrawal reopening, reserves. Updated on each notice.
Updated
Topic
Incidents
Hacks, withdrawal suspensions and regulatory actions, written from official notices only.
Draft hub intro: not finished.
We track hacks, withdrawal suspensions and regulatory actions at the exchanges we cover, written from the exchanges’ and regulators’ official notices only.
| Exchange | Withdrawal status | Last incident on record |
|---|---|---|
| Binance | Normal (EU users: withdrawal-only) | 1 Jul 2026, regulatory: No MiCA licence; EU new registrations halted and services wound down; Binance says assets remain accessible. Earlier: on 21 Nov 2023 Binance pleaded guilty in the US to conspiracy to violate the Bank Secrecy Act, failure to register as a money transmitting business and violating sanctions law (IEEPA), and agreed to pay $4.3 billion and retain an independent monitor, according to the US Department of Justice. |
| Bybit | Normal | 21 Feb 2025, hack |
| OKX | Normal | 24 Feb 2025, regulatory: Aux Cayes Fintech Co. Ltd, the Seychelles-based company that has operated OKX since at least 2017, pleaded guilty in the US to one count of operating an unlicensed money transmitting business and agreed to pay penalties totalling more than $504 million (forfeiture of $420.3 million and a criminal fine of approximately $84.4 million), according to the US Department of Justice. |
| Bitget | Restored | 24 Sep 2026, hack |
| MEXC | Normal (platform-wide) | Not yet verified |
| KuCoin | Normal | 19 Feb 2026, regulatory: On 19 Feb 2026 Austria's FMA prohibited KuCoin EU Exchange GmbH from new business because its Anti-Money-Laundering Officer and Sanctions Compliance Officer functions were no longer properly filled; the FMA lifted that ban on 18 May 2026 after the posts were filled again, but says commencement of business operations remains prohibited under its decision of 18 Feb 2026, because governance requirements and further senior-management key functions are not yet met. Earlier: on 27 Jan 2025 Peken Global Limited, the Seychelles-based company that has operated KuCoin since at least September 2019, pleaded guilty in the US to one count of operating an unlicensed money transmitting business and agreed to pay penalties totalling more than $297 million ($184.5 million forfeiture and a criminal fine of approximately $112.9 million); KuCoin will exit the US market for at least two years, according to the US Department of Justice. |
| Gate (Gate.com) | Normal | Not yet verified |
| BingX | Normal | 20 Sep 2024, hack: Hot-wallet breach; BingX called losses 'minor'; third-party estimates $26.7M→$43M+ (PeckShield), >$47M (SlowMist) |
| Kraken | Normal | Not yet verified |
| Coinbase | Normal | 15 May 2025, data breach (insider): Overseas support contractors bribed to copy customer data; 69,461 individuals notified; no passwords/keys/funds accessed per Coinbase; $20M ransom refused; est. remediation $180M–$400M (company estimate) |
| CoinDCX | Normal | 19 Jul 2025, hack: CoinDCX says one internal operational account used only for liquidity provisioning on a partner exchange was compromised via a server breach; customer funds in segregated cold wallets were not affected; loss covered from CoinDCX treasury; CERT-In notified; recovery bounty up to 25% of recovered funds. |
| CoinSwitch | Normal | Not yet verified |
| Mudrex | Normal (no 2026 suspension found) | 11 Jan 2025, withdrawal suspension: Mudrex paused crypto withdrawals from 2025-01-11, saying the pause would last until 2025-01-28 while it upgraded compliance systems. |
| ZebPay | Normal | Not yet verified |
Written from official notices only. "Not yet verified" means we found no reliable source for that cell, not that nothing happened. We do not estimate user losses.
Incident trackers