Bitget is currently considered operational, but its long-term safety remains a subject of intense debate following a massive $387.5 million security breach on September 24, 2026. While the CEO has publicly assured users that the exchange's internal protection fund has covered all losses, the sophisticated nature of the attack—which targeted internal withdrawal processes—suggests that fundamental structural vulnerabilities were present. For US users, the platform's safety is now tied to the efficacy of its newly implemented security protocols and its ability to withstand state-level cyber threats.
The heist, which occurred late in September 2026, saw attackers manipulate the exchange's internal withdrawal engine to siphon funds directly from the platform's reserves. Chainalysis, a leading blockchain forensics firm, has officially attributed the attack to North Korean state-sponsored hackers. This attribution is particularly concerning as it marks one of the largest centralized exchange exploits of the year, highlighting a shift in tactics toward compromising the internal logic of exchange software rather than just stealing private keys.
From a regulatory and geopolitical perspective, the involvement of North Korea places Bitget under significant pressure from US authorities. The Office of Foreign Assets Control (OFAC) and the Department of Justice (DOJ) typically increase scrutiny on platforms that fail to prevent state-sponsored money laundering or theft. For US-focused crypto intelligence, this event underscores the rising risks of using offshore centralized exchanges (CEXs) that may not meet the stringent cybersecurity standards expected by American regulators.
Market participants are currently monitoring Bitget’s proof-of-reserves (PoR) for any signs of undisclosed liquidity gaps. Moving forward, the exchange must provide a transparent, third-party audit of its withdrawal systems to regain full market trust. Investors should watch for further statements from the CEO regarding the specific technical upgrades made to the withdrawal engine and whether the exchange will seek new insurance policies to supplement its existing protection fund. Until these measures are verified, the incident serves as a reminder of the inherent risks of centralized custody.