Bitget Review 2026: Is It Safe? The September 2026 US$388 Million Hack, Proof of Reserves, Protection Fund, Fees and Sign-up

I started on Bybit and Binance, then also began using Bitget because its fee discount was higher.

The short version: Bitget was founded in 2018 and says it has more than 120 million users. The most important thing to know is that on 24 September 2026 about US$388 million was stolen from its hot wallets. Withdrawals were paused and then restored in stages, fully on 2 October, and the loss was absorbed by the company and its protection fund. The reserve snapshot after the hack showed a total reserve ratio of 131%, but Bitget publishes this report itself, with no third-party audit. Regular users pay 0.1% on spot, and paying with BGB lowers that further.

This article shares my own experience and research. It is not investment, tax or legal advice. Fees, rates, licences and service regions can change; every figure here is dated, so check Bitget’s official pages before you act. Crypto prices are volatile, and keeping assets on an exchange carries the risk of the exchange itself.

Bitget key factsData checked: 2026-10-08

As of 2026-10-08, Bitget's general-user spot taker fee is 0.1% and its futures taker fee is 0.06%; signing up with the invitation code gives a 20% trading fee discount. Its 2026-09-29 proof of reserves showed BTC 142%, ETH 110%, USDT 107%.

Item	Details	Source
Jason Finance rating	65.2 / 100	rating method
Highlights	Disclosed protection fund BTC reserve ratio 142% Sept 2026 hack covered by its protection fund
General-user fees (taker)	Spot 0.1%, futures 0.06%	2026-10-08
Invitation code fee discount	20% trading fee discount	2026-10-07
Proof of reserves	2026-09-29 (monthly): BTC 142%, ETH 110%, USDT 107%	2026-10-08
Main licences and registrations	El Salvador CNAD licence, South Africa FSCA licence, Mauritius FSC licence, Australia AUSTRAC registration, Argentina CNV registration	source 1 source 2 source 3 source 4 source 5
USDT withdrawals	Cheapest BEP20 0.01 USDT; 7 common networks supported	2026-10-08
Order book depth (±2%)	BTC/USDT about 10.6M USD, ETH/USDT about 5.7M USD	2026-10-08

What kind of exchange Bitget is

Sources: Bitget About us and CoinGecko.

Is Bitget safe?

The September 2026 hack: about US$388 million, withdrawals paused for about a week

According to Bitget’s incident report (updated 3 October):

• What happened: at 18:31 UTC on 24 September 2026, attackers used a vulnerability in a third-party security product to obtain high-privilege internal credentials and sent forged withdrawal instructions to the wallet back end. The stolen funds came from 12 hot and warm wallet addresses on 11 chains. Bitget says cold wallets were not affected and has ruled out a private key leak.
• Amount: Reuters first reported about US$351.6 million; Bitget’s final figure was about US$388 million (Reuters report, republished).
• User balances: Bitget says user account balances were not affected and the loss was absorbed by the company and its protection fund. The CEO told Reuters that pausing withdrawals was a security precaution, not a sign of insufficient funds.
• Withdrawals restored: BTC on 28 September, ETH on 29 September, USDT on 30 September, and other coins, fiat and C2C on 2 October.
• Investigation: Mandiant and SlowMist released investigation reports on 30 September. Chainalysis and Elliptic linked the attack to North Korea; Bitget itself has not formally attributed it (The Defiant).

I think the two sides of this need to be kept apart. User balances were not affected because Bitget had a protection fund and its own money to absorb the loss; but from 24 September to 2 October users could not withdraw for a while, and USDT had to wait until 30 September. Some older Bitget pages still say “no security incidents since 2018”, which is no longer true.

Proof of reserves: monthly, 131% total after the hack

A proof of reserves compares what an exchange holds in its wallets with the total of all user balances. Bitget has published one every month since December 2022, with a Merkle tree so users can verify it themselves, and on 17 September 2026 it expanded coverage from 4 coins to 19.

For the 47th report, media reported ratios of BTC 142%, ETH 110%, USDT 107% and USDC 154% (ChainCatcher); Bitget’s own announcement gives the total reserve ratio and shows the per-coin ratios as images.

Bitget’s proof of reserves has no third-party audit and no zero-knowledge proof. Bitget itself notes that a ratio above 100% only reflects the moment of the snapshot; it is not a financial audit and does not guarantee future solvency.

Protection fund: more than US$300 million, according to Bitget

Bitget’s protection fund was set up in 2022 with 5,500 BTC, with a commitment to keep at least US$300 million in it. It is meant for user losses caused by platform-level incidents, subject to Bitget’s investigation and claims review.

The losses from the September hack were absorbed by the protection fund. In a 30 September announcement, Bitget said the fund had been topped back up to more than US$300 million on 28 September. The fund’s live balance is only shown dynamically on the official site.

Account security settings

Security features Bitget offers (official guide):

• Login and verification: three kinds of 2FA (SMS, Google Authenticator and passkey), trusted device management and a face recognition lock for the app.
• Withdrawals: a fund password, cross-device withdrawal verification (approve by scanning a QR code in the app), and the option to cancel a withdrawal within one minute (on by default).
• Anti-scam: an anti-phishing code; once it is set, Bitget’s official emails and text messages include it.

Bitget licences and service regions

Licences and registrations listed on Bitget’s licence page (7 October 2026):

These are Bitget’s own listings; I did not check each one against the regulators’ registers.

• European Union: Bitget has no MiCA authorisation. Bitget EU has applied to Austria’s FMA, and the CEO said it will not serve the European Economic Area until it is authorised (Cryptonomist).
• Japan: Japan’s Financial Services Agency issued warnings in March 2023 and November 2024 (FSA list). Bitget has stopped new registrations from Japan and will force-close Japanese residents’ open positions after 31 December 2026.
• Hong Kong: it dropped its Hong Kong licence application in 2023 and stopped operating there.

Restricted regions: under the terms of use (updated 15 September 2026), these include the United States, Canada, Hong Kong, Singapore, Japan, Malaysia, Thailand, Kazakhstan, France, Germany, Austria, North Korea, Iran and Cuba, and the terms also prohibit using a VPN to get around them.

Other record: in April 2025 the VOXEL futures market saw abnormal trading. Bitget concluded that some accounts may have manipulated the market, rolled back the trades involved and compensated affected users (The Block).

How to sign up for Bitget

Create an account with an email address or phone number, enter the invitation code in the invitation code field, then complete identity verification (KYC). All Bitget users must complete KYC.

Bitget trading fees: 0.1% spot, with a BGB discount

From Bitget’s fee explanation and official API (7 October 2026):

• Meeting any one threshold (assets, 30-day volume or BGB holdings) moves you up a tier. The volume for VIP 1 is 500,000 USDT on spot or 5 million USDT on futures; the BGB threshold is adjusted to the price every two weeks and has no fixed number.
• Compared with Bybit and OKX, Bitget’s VIP 1 asset threshold is much lower (30,000 USDT against US$100,000).
• BGB discount: paying spot fees with BGB gives a 20% discount according to Bitget’s 2025 explanation (0.1% becomes 0.08%). It applies only to spot and margin, not futures. The discount figure on the live page is loaded by a script, so go by what it shows at the time.
• The futures rates are for USDT-margined futures.

In money terms: a regular user buying 1,000 USDT of BTC at market pays 1 USDT in fees, or 0.8 USDT when paying with BGB.

Withdrawal fees (official API, 7 October 2026; minimum withdrawal 10 USDT):

Withdrawal fees move with blockchain costs; the withdrawal page shows the current fee.

Depositing USDT to Bitget on-chain

On Bitget’s deposit page, choose USDT and a network, copy the address, and withdraw from the sending side. Both sides must use the same network, or the funds may not be recoverable.

Data from Bitget’s official API (7 October 2026). Bitget supports 12 networks in total; the deposit page shows the current figures.

Bitget earn: Simple Earn Flexible and the cash product

• Simple Earn Flexible: redeem at any time with no penalty, and the funds go straight back to the spot account. Interest is calculated daily, and subscriptions made before 16:00 (Taipei time) start earning the same day (official explanation). Bitget’s explanation does not say where the flexible yield comes from.
• Rates: on 7 October 2026 the page showed several USDT flexible products at once. One was tiered, with 7.93% up to 300 USDT and 3.27% on the part above that, and rates change daily. Which product you can subscribe to, and at what rate, depends on what the app shows at the time.
• Cash product: another product launched in 2026. USDT or USDC goes into USDGO, a US dollar stablecoin backed by short-term US Treasuries, cash and similar assets, and it paid about 4% APR at launch (official explanation). Bitget describes the principal as “protected”; that is Bitget’s own claim.

USDT in an exchange earn product carries two layers of risk: USDT itself and the exchange. For a comparison with short-term Treasury ETFs, Aave and Bitfinex lending, see Where to park idle USD and USDT.

Pros and cons: who Bitget suits

For other international exchanges to compare, see the Bybit review and the OKX review. More exchange guides and comparisons are on the crypto topic page.

FAQ

Is Bitget safe?

Bitget publishes a proof of reserves every month. The snapshot of 29 September 2026, taken after the hack, showed a total reserve ratio of 131%, and Bitget says it keeps a protection fund of more than US$300 million. But about US$388 million was stolen from it on 24 September 2026, and withdrawals were not fully restored until 2 October. Bitget publishes its proof of reserves itself, with no third-party audit.

Were Bitget users' assets affected by the hack?

Bitget says the stolen funds came from 12 hot and warm wallet addresses on 11 chains, that cold wallets were not affected, and that user account balances were not affected, with the loss absorbed by Bitget and its protection fund. Withdrawals resumed in stages from 28 September and were fully restored on 2 October.

What are Bitget's trading fees?

Regular users pay 0.1% maker and 0.1% taker on spot, and 0.02% maker and 0.06% taker on USDT-margined futures. Paying spot fees with BGB gives a 20% discount according to Bitget's 2025 explanation; check the live rates on the official site.

How large is Bitget's protection fund?

Bitget's protection fund was set up in 2022 with 5,500 BTC, and Bitget commits to keeping at least US$300 million in it. The fund absorbed the losses from the September 2026 hack, and Bitget says it was topped back up to more than US$300 million on 28 September.

Where is Bitget not available?

Under Bitget's terms of use updated on 15 September 2026, it cannot be used in the United States, Canada, Hong Kong, Singapore, Japan, Malaysia, Thailand, Kazakhstan, France, Germany, Austria and other places. Bitget also says it will not serve the European Economic Area until it obtains MiCA authorisation.

Can I redeem Bitget's flexible savings at any time?

Bitget's Simple Earn Flexible can be redeemed at any time with no penalty, and the funds go straight back to the spot account. Interest is calculated daily and the APR moves with the market. Bitget's explanation does not say where the flexible yield comes from.