On the evening of September 24, 2026, a Bitget customer trying to withdraw funds would have run into a terse message: withdrawals suspended. A few hours earlier, at 18:31 UTC, the platform had detected unauthorized transfers from its hot wallets. The toll announced by the exchange: $351.6 million stolen, likely the largest crypto hack of the year.
Most coverage asks whether Bitget will reimburse its users (the answer appears to be yes). We want to ask a different question, one that is more useful to you: if it had been your exchange that night, how much of your crypto wealth would have been stuck? If you can't answer in a few seconds, this article is for you.
What happened, in short
According to CEO Gracy Chen, as reported by CoinDesk, the attackers compromised a backend system within Bitget's wallet infrastructure. They used it to falsify transaction data, then let the platform's own authorization process approve transfers that looked legitimate. No private keys were reportedly stolen, and customer withdrawal requests were not forged: the exchange's internal machinery was turned against it.
The stolen assets spanned several networks (ETH, BNB, AVAX and USDT among them), were quickly consolidated, and were partly swapped into ETH to escape potential stablecoin freezes. Bitget itself pointed to North Korea, citing IP addresses matching the VPNs used by a group linked to the country. Nothing is officially established yet, but the pattern recalls the Bybit hack of February 2025, roughly $1.5 billion, which the FBI attributed to the Lazarus Group.
What held up: the offline cold wallets were not touched. The breach was limited to the hot and warm layers. And Bitget's user protection fund, worth more than $464 million, is expected to cover the full loss.
What was cut off: deposits and trading remain open, but withdrawals are frozen for all customers, with no announced date for resumption.
The real risk isn't theft, it's the freeze
If Bitget keeps its word, no customer will lose a cent. That's good news, and it's also what makes the event misleading. For as long as the security review lasts, customers own crypto they cannot move.
In practice, an asset you can't withdraw is an asset that has lost its liquidity. You can't send it to another exchange if the market moves, you can't secure it in your own wallet, and you can't use it if you need it. Your wealth still exists on paper, but it is frozen in place.
French Bitget users have already lived through this scenario in another form. At the end of March 2026, the platform stopped serving French residents, and those who hadn't planned ahead had to follow a forced exit procedure, detailed in our guide to recovering funds after March 31, 2026. Regulatory shutdown, hack, bankruptcy or an account frozen for verification: the causes differ, the outcome is the same. Your funds depend on a decision you don't make.
The diversification almost nobody does
Many investors carefully spread their portfolio across Bitcoin, Ethereum and a few altcoins. Very few spread where those assets are held.
Yet a portfolio of ten different cryptos, all held on the same exchange, has a single point of failure. From a counterparty risk perspective, it isn't diversified at all. This is one of the blind spots we describe in our article on crypto diversification: correlation between your assets matters, but so does concentration with a single custodian.
A reminder of the basics: on an exchange, you don't hold your crypto, you hold a claim on the platform, which keeps the private keys. That's the whole point of the saying "Not your keys, not your crypto". A protection fund like Bitget's is a business policy, not a legal guarantee comparable to bank deposit insurance. When Mt. Gox and FTX collapsed, no such safety net existed.
Measuring your exposure by platform
The good news is that this risk is very easy to measure. It comes down to one question: where is each dollar of your portfolio?
Step 1: list every place you hold crypto. Every exchange where you have a balance, every hot wallet (MetaMask, Phantom, a mobile app), every cold wallet. Don't forget small balances left on platforms you no longer use: they are often the ones that cause trouble when a platform shuts down.
Step 2: calculate each platform's share. Divide the value held in each place by the total value of your portfolio. You get a breakdown such as: 55% on one exchange, 10% on a second one, 5% in a hot wallet, 30% in a cold wallet.
Step 3: run the freeze test. For each platform, ask yourself: if its withdrawals were blocked for three months, could I live with it? If the answer is no for a platform holding more than half of your capital, you've found your main risk, before even talking about volatility.
Step 4: set yourself a rule. There is no universal threshold, but a simple rule helps: keep on an exchange only what you trade or plan to use in the short term, and hold the rest in a wallet whose keys you control. Some investors add a per-platform cap, for example never exceeding a set percentage of the portfolio with any one custodian.
In Exceefy, a simple way to visualize this breakdown is to create one portfolio per platform (one per exchange, one per wallet). The dashboard then shows at a glance how much of your capital depends on each custodian, and how that share shifts as prices move.
Your history shouldn't live on the exchange
There's a second, less visible lesson. When a platform freezes withdrawals, shuts down or locks you out, you may also lose access to your transaction history.
That history is essential. It is what you use to calculate capital gains for your tax return, and in some countries, including France, an account held on a foreign platform must be declared every year. It also helps you prove the origin of your funds to your bank when you cash out.
Export your history as CSV regularly, without waiting for an incident, and store it somewhere other than the platform. Better still, import it into an independent tracking tool: your data stays accessible even if the exchange disappears overnight. That's exactly what Exceefy's CSV import allows, and it supports Bitget exports.
After a hack, the next threat is phishing
Every high-profile hack is followed by a wave of scams impersonating the affected platform: fake "refund" emails, fake claim forms, fake support on Telegram. Attackers exploit customers' anxiety, and these messages are increasingly convincing, as we explain in our article on AI-powered crypto phishing.
The rule is simple: don't click any link you receive, never share your seed phrase or codes, and only use the official app or website. To put this episode in the history of exchange thefts, our article on the biggest crypto hacks shows the same scenario has repeated itself for more than a decade.
FAQ
Will Bitget customers lose their funds?
According to Bitget, no. The $351.6 million loss is expected to be covered by the user protection fund, which exceeds $464 million, and the cold wallets were not affected. However, withdrawals remained frozen with no announced resumption date at the time of publication.
How much of my portfolio can I leave on an exchange?
There is no universal percentage. A common approach is to keep on the exchange only what you actively trade or plan to use in the short term, and to hold the rest in a wallet whose keys you control. What matters most is knowing your breakdown and being able to withstand any single platform freezing.
Were the private keys stolen in the Bitget hack?
No, according to Bitget. The attackers compromised a backend system and falsified transaction data so that the platform's authorization process approved the transfers. The cold wallets, which hold most reserves, were not affected.
Why should I export my transaction history?
Because in case of a freeze, shutdown or bankruptcy, you may lose access to your account. Your history is needed for your tax return and to prove the origin of your funds. A regular CSV export, stored outside the platform, protects you against that risk.
