Exchange Notebook

Is Bitget Safe? The 2026 Hack, Proof of Reserves, Licences and What It Means for You

By Exchange Notebook Editor · Published 1 November 2026 · Updated 1 November 2026

Disclosure: This article contains my Bitget referral link. If you sign up through it and trade, I may receive a share of your trading fees from Bitget. It does not change the fees you pay. I am not employed by Bitget, and nothing here is financial advice.

“Is Bitget safe?” is the right question to ask before you deposit money on any exchange, and in late 2026 it has a more complicated answer than usual. On 24 September 2026 Bitget suffered a major security incident. This guide covers what happened, what Bitget says it did about it, how its Proof of Reserves and Protection Fund work, what licences it holds in Australia and South Africa, and the risks no exchange can remove. Everything below was checked against Bitget’s own pages and regulator sources on 1 November 2026.

Short answer: no centralised exchange is risk-free. Bitget publishes monthly Proof of Reserves and keeps a separate Protection Fund, and it says user balances were not affected by the September 2026 hack. But the hack itself shows that exchange custody carries real risk, and Bitget’s regulatory status varies a lot by country. Keep only what you need on any exchange.

What happened in the September 2026 Bitget hack

According to Bitget’s security incident update (last updated 20 October 2026):

Bitget states that user account balances were not affected and that the financial impact was covered by its Protection Fund. Asset tracing and recovery were still ongoing at the time of writing.

What the hack tells you

Two things can be true at once. Bitget appears to have absorbed a very large loss without reducing customer balances, and it restored withdrawals within about eight days. At the same time, an attacker was able to move hundreds of millions of dollars out of its operational wallets through a supplier’s vulnerability. That is the core risk of leaving crypto on any exchange: you depend on the operator’s security and its ability to cover losses.

Proof of Reserves: what it shows and what it does not

Bitget has published Proof of Reserves (PoR) reports since December 2022. Its October 2026 report, published on 30 October, was the 48th and reported:

The previous report, based on a 29 September snapshot taken after the hack, showed an overall ratio of 131%.

Bitget’s PoR page says it publishes a monthly Merkle tree so users can verify that their own balance was included in the snapshot, and that it uses open-source tools to verify ownership of its reserve wallet addresses.

Limits to keep in mind:

  1. A snapshot is a moment in time. It shows reserves against covered user balances on the snapshot date, not every day in between.
  2. Coverage is limited to listed assets. Assets outside the 19 covered ones are not in the ratio.
  3. No auditor is named on the page. The PoR page I read describes Bitget’s own verification method and does not name an independent auditor. PoR is not the same as a full financial audit of a company’s assets and liabilities.

PoR is still useful. Exchanges that publish verifiable reserves regularly give you more information than those that do not. Just do not treat it as a guarantee.

The Bitget Protection Fund

The Protection Fund is separate from the reserves that back user balances. Bitget says:

Because the fund is held in BTC, its US dollar value moves with the bitcoin price. Bitget’s own Protection Fund page also says it assesses each claim, and claims relate to platform-wide incidents not caused by the user’s own actions. It is not insurance against trading losses or against you being phished.

Licences and registrations in Australia and South Africa

This site is written for readers in Australia and South Africa.

Australia. Bitget’s licence page lists a digital currency exchange provider registration with AUSTRAC, and AUSTRAC’s register shows BTGT AUS PTY LTD trading as Bitget. AUSTRAC registration is an anti-money-laundering registration, not an Australian Financial Services (AFS) licence, and it does not mean a regulator has assessed the exchange’s security. ASIC has issued an investor alert warning Australians about Bitget’s unlicensed crypto asset futures products and stating that Bitget does not hold an AFS licence. This site does not recommend Bitget futures to Australian readers.

South Africa. Bitget’s licence page lists a Crypto Asset Service Provider (CASP) licence and an Over-the-Counter Derivatives Provider (ODP) licence from the Financial Sector Conduct Authority (FSCA). Bitget’s Stock+ FAQ names Parsa Financial Services (Pty) Ltd, FSP 52563, as the FSCA-licensed entity for that service. You can check any provider on the FSCA’s public register.

Elsewhere. Bitget’s Terms of Use (last updated 20 October 2026) list Prohibited Countries including Austria, Belarus, Canada, Cuba, France, Germany, Hong Kong, Iran, Japan, Kazakhstan, Malaysia, North Korea, Russia, Singapore, Sudan, the United States and its territories, Iraq, Libya, Yemen, Afghanistan, the Central African Republic, the Democratic Republic of the Congo, Guinea-Bissau, Haiti, Lebanon, Somalia, South Sudan, Thailand, and parts of Ukraine. The Terms say you must not use a VPN to get around these restrictions. In the European Union, Bitget’s MiCAR update (2 July 2026) says Bitget EU has applied to Austria’s Financial Market Authority for authorisation; I found no announcement that it had been granted as of 1 November 2026.

Account security features you control

Many crypto losses come from phishing and stolen logins rather than exchange hacks. Bitget’s security notices describe several tools and warnings:

How to reduce your risk on any exchange

  1. Keep only what you are actively trading on the exchange. Move longer-term holdings to a wallet you control, and learn how to back it up properly first.
  2. Use a unique password and 2FA, and never share one-time codes.
  3. Avoid leverage if you are new. Futures and copy trading can lose money much faster than spot buying.
  4. Check your local rules. Make sure the exchange is allowed where you live and understand what protections you do and do not have.
  5. Watch the official channels for incident notices rather than social media rumours.

Risk warning

Crypto assets are highly volatile, and you can lose all of the money you put in. Exchange hacks, outages, insolvency and regulatory action can also cause losses or delays in getting your money back. Futures, margin and copy trading carry higher risk because leverage magnifies losses. Proof of Reserves and protection funds do not remove these risks. Nothing in this article is financial, tax or legal advice.

Bottom line

Bitget is a large exchange that publishes monthly reserve data and keeps a separately disclosed Protection Fund, and it says its September 2026 hack did not reduce customer balances. It is also an exchange that lost about $388 million from its operational wallets in 2026, and whose standing with regulators differs sharply from one country to the next. If you decide to use it, treat it as a place to trade, not a place to store savings.

If Bitget is available where you live and you accept these risks, you can open a Bitget account with my referral link. For how the referral code works, see the Bitget referral code guide, and for costs, see Bitget fees explained.

FAQ

Was Bitget hacked?

Yes. Bitget says that on 24 September 2026 attackers used a zero-day vulnerability in a third-party security product to send forged withdrawal commands from part of its hot and warm wallets. The final verified amount affected was about $388 million. Bitget says cold wallets and private keys were not compromised.

Did Bitget users lose money in the hack?

Bitget says user account balances were not affected and that the loss was covered by its Protection Fund. Withdrawals were paused and fully resumed on 2 October 2026.

What is Bitget’s Proof of Reserves ratio?

Bitget’s October 2026 report, published on 30 October, showed an overall reserve ratio of 115% across 19 covered assets, with every covered asset at or above 1:1. The figure changes monthly.

How big is the Bitget Protection Fund?

Bitget says it restored the fund above its $300 million minimum on 30 September 2026, and its latest official update says the fund holds 3,705 BTC. Its dollar value moves with the bitcoin price.

Is Bitget regulated in Australia?

Bitget is registered with AUSTRAC as a digital currency exchange provider (BTGT AUS PTY LTD). That is an anti-money-laundering registration, not an AFS licence. ASIC has warned Australians about Bitget’s unlicensed futures products.

Is Bitget licensed in South Africa?

Bitget’s licence page lists an FSCA Crypto Asset Service Provider licence and an Over-the-Counter Derivatives Provider licence. You can confirm details on the FSCA’s public register.

Sources (checked 2026-11-01): Bitget security incident explainer, updated 20 Oct 2026 (bitget.com/academy/bitget-security-incident-what-happened-timeline-impact-response); Bitget October 2026 Proof of Reserves report (bitget.com/blog/articles/bitget-october-2026-proof-of-reserves); Bitget September 2026 PoR report (bitget.com/blog/articles/september-2026-proof-of-reserves-131-percent); Bitget Proof of Reserves page (bitget.com/proof-of-reserves); Bitget Protection Fund page (bitget.com/protection-fund); Bitget Protection Fund replenishment update (bitget.com/blog/articles/protection-fund-restored-above-300-million); Bitget phishing alert (bitget.com/support/articles/12560603814034); Bitget SDK supply chain warning (bitget.com/support/articles/12560603820084); Bitget Terms of Use (bitget.com/support/articles/360014944032); Bitget regulatory licences (bitget.com/promotion/regulatory-license); Bitget MiCAR update (bitget.com/support/articles/12560603885949); ASIC investor alert on Bitget futures (asic.gov.au).