Bitget Hack (Sep 2026): Timeline and Withdrawal Status

What happened

• When: 24 September 2026. Bitget’s timeline places the first unauthorised transfers at 18:31 UTC.
• Which wallets: 12 wallet addresses linked to hot or warm wallets. In Bitget’s words: “Cold wallets across all chains were not affected.”
• Which chains (11): Ethereum, XRP Ledger, Zcash, TRON, Arbitrum, Optimism, Base, BNB Smart Chain, Avalanche, Algorand and Celestia.
• Cause (per Bitget): a vulnerability in a third-party security product was used to obtain high-level internal credentials, which were then used to issue fraudulent withdrawal commands. Bitget says private-key compromise has been ruled out.
• Amount: “The final verified amount affected is approximately $388 million.”

Source for all five points: Bitget official incident page, verified 10 Oct 2026.

Timeline (UTC)

Scroll sideways to see all columns

Source: Bitget official incident page, verified 10 Oct 2026.

Can I withdraw from Bitget now?

According to Bitget, yes. All reopening phases were complete by 2 October 2026 at 08:00 UTC.

We have not found reports of continued delays after 2 October (as of 10 Oct 2026). This is a negative finding from our search, not a guarantee. Individual accounts can still be held for checks unrelated to the incident.

WithdrawFirst does not open exchange accounts or move funds, so this is not a time we measured. For Bitget’s general withdrawal rules and fees, see our Bitget review.

Withdrawal & freeze record: Bitget

Withdrawal record (researched, not tested)

Researched WithdrawFirst does not open exchange accounts, deposit or withdraw funds. This section summarises Bitget's own withdrawal rules and notices, public incident reports and our dated complaint sample. Last verified 10 Oct 2026.

Incidents & withdrawal status

Withdrawals open 2026-09-24: all wallet withdrawals: Suspended after a security incident and reopened in stages at 08:00 UTC: BTC on 28 Sep, ETH on 29 Sep, USDT on 30 Sep, other tokens, fiat and C2C on 2 Oct 2026.checked 11 Oct 2026 · source (opens in a new tab)

Last incident: 24 Sep 2026, hackchecked 20 Oct 2026 · source (opens in a new tab)

Incident tracker

What Bitget says

Processing time (the exchange's own estimate)

Bitget says pending withdrawals are usually processed within a few minutes, but blockchain congestion can delay them; larger transactions may be reviewed manually and flagged transactions may be held.checked 11 Oct 2026 · source (opens in a new tab)

Withdrawal fees

BTC (Bitcoin) 0.00002 BTC; ETH (Ethereum (ERC20)) 0.00004457 ETH; USDT (Tron (TRC20)) 1.5 USDT; USDT (BNB Smart Chain (BEP20)) 0.01 USDT (checked 31 Oct 2026)

Official appeal route

Bitget describes no separate appeal process for frozen assets. It asks you to check the Notification Center, complete or update identity verification, cancel any open orders or P2P trades holding the funds, check your withdrawal whitelist and asset-lock settings, and, if the cause is still unclear, submit a support ticket with transaction IDs, error messages and account details. Bitget says frozen funds stay in your account until the issue is resolved.checked 11 Oct 2026 · source (opens in a new tab)

Account frozen? What to do

If a withdrawal is stuck:

• Use Bitget’s official channels only. Bitget’s notice tells users to refer only to its official website, app, Support Center and verified social channels for the latest information. Bitget’s incident notice links these.
• Bitget also warns users to “Be cautious of phishing links, impersonation accounts, unofficial recovery services and unverified information”. Nobody legitimate will ask for your password, 2FA codes or a fee to “recover” funds.
• Bitget describes no separate appeal process for frozen assets. It asks you to check the Notification Center and your identity verification, cancel open orders or P2P trades holding the funds, check your withdrawal whitelist and asset-lock settings, and then submit a support ticket with transaction IDs and error messages; it publishes no response deadline (Bitget frozen-assets help, verified 11 Oct 2026).

If your account itself is frozen (not the platform), our frozen-account guide sets out what to do, in order.

Were user funds affected?

Here is what Bitget says, and nothing more:

• Balances. “User account balances remain unaffected.”
• Protection Fund. “The Bitget Protection Fund is replenished to more than $300 million.” Bitget dates this to 30 September 2026, 09:00 UTC.
• Reserves. “Based on the September 29 snapshot, Bitget’s latest overall reserve ratio stands at 131% across 19 covered assets.”

Source: Bitget official incident page, verified 10 Oct 2026.

What these terms mean, and what they do not prove:

• A protection fund is a reserve an exchange says it holds to cover users in events like this. Its size is what the exchange reports. We have not verified the fund’s holdings, and we do not assess whether it is enough.
• Proof of reserves compares the assets an exchange holds with what it owes users for the covered assets, at one moment. It is a snapshot, not continuous coverage. It covers only the listed assets, and how fully it reflects liabilities depends on the method used. The 131% figure is Bitget’s own reported ratio for the 29 September snapshot.

We do not estimate user losses and we do not assess Bitget’s solvency.

What Bitget says caused it

Bitget’s notice says: “The attacker exploited a vulnerability in a third-party security product to obtain high-level internal credentials.” Those credentials were then used to issue fraudulent withdrawal commands. Bitget adds: “Private-key compromise has been ruled out.”

Bitget’s notice does not name the attacker. On attribution, it says: “Attribution should only be treated as confirmed if supported by verified investigative findings.”

Source: Bitget official incident page, verified 10 Oct 2026.

Conflicting numbers and claims, reconciled

Different figures circulated in the first days. This table shows what we use and why.

Scroll sideways to see all columns

What this means if you use Bitget, or are choosing an exchange

These are general habits for any exchange, not a judgement on Bitget:

• Keep only what you are actively trading on an exchange. Funds you are not using can sit in a wallet you control.
• Withdraw regularly, rather than letting balances build up.
• Turn on 2FA and a withdrawal-address whitelist, so a stolen password alone cannot send funds to a new address.
• Watch official status pages and the exchange’s verified channels during any incident. Ignore “recovery” offers from strangers.
• Check that an exchange serves your country before opening an account. Bitget does not serve every market. For example, Bitget paused new sign-ups in India from 6 February 2026 and we found no evidence that it is registered with India’s FIU-IND, so Bitget is not available to new users in India. FIU-IND publishes no public registry, so registration status can only be confirmed through FIU orders and exchange announcements. Our Bitget review lists availability by country.

If you are comparing exchanges, these pages may help:

• Bitget review: fees, availability and safety record
• Binance alternatives by country
• Best copy trading platforms
• How we review exchanges, including how we handle incidents

All incidents we track: /incidents/.

Update log

• 10 Oct 2026: Page created from Bitget’s incident notice (updated 3 Oct 2026). Official page re-checked on 10 Oct 2026; no newer incident update found.

---

Crypto assets are volatile and you can lose all the money you put in. Exchanges can freeze accounts, suspend withdrawals or stop serving your country. Nothing on this site is financial advice. Read our risk warning.

Source: Bitget official announcements. We do not estimate user losses.