Bitget

Bitget is a global cryptocurrency exchange founded in Singapore in 2018 and best known for running the largest copy trading marketplace in the industry. It offers spot and derivatives markets, an Earn suite and, increasingly, tokenized versions of assets that are not crypto at all. It is led by CEO Gracy Chen and reports more than 120 million registered users.

It is also, as of late September 2026, the exchange that absorbed the largest crypto hack of the year without a single customer losing money. That event tells you more about how Bitget is built than any feature list, so it is covered in full below.

Copy Trading Is the Actual Product

Plenty of exchanges offer copy trading as a checkbox feature. On Bitget it is the centre of the business, and the platform describes itself as the largest crypto copy trading venue in the world.

The mechanic is simple: traders publish their positions, followers allocate capital, and trades replicate automatically in the follower's account with the lead trader taking a share of profits. Bitget's edge is population density. A marketplace with enough lead traders across enough strategies produces useful selection, and rankings built on real track records are more informative than the handful of accounts smaller platforms can show.

The risk is equally structural and worth stating plainly. Ranking tables reward whoever most recently took the most leverage, which is the opposite of what a follower should want. A lead trader's incentive is a profit share with no downside exposure to your capital, so a blown-up account costs them their ranking and costs you your money. Historical returns on a leveraged perpetual strategy tell you almost nothing about survivability through a real drawdown, and crypto volatility punishes exactly the strategies that look best in a trending month.

Copy trading is a genuine convenience if you treat it as allocating to a risky manager. It is not a substitute for knowing what the positions are.

The Pivot to Assets That Are Not Crypto

Bitget has spent 2026 repositioning itself as what Chen calls a Universal Exchange, or UEX, and the numbers behind that pitch are the most interesting thing about the company's strategy.

The platform now lists access to over two million tokens plus more than 500 tokenized stocks, ETFs, commodities, foreign exchange pairs and precious metals including gold. By Bitget's own first-quarter 2026 data, non-crypto assets accounted for roughly 40 percent of total platform trading volume. That is not a side product. Two fifths of the flow through a crypto exchange is now something other than crypto.

The stated long-term direction is tokenization plus artificial intelligence, with a single account reaching multiple financial markets. Bitget Wallet serves as the on-chain layer, integrating modular decentralized applications, which keeps the Web3 and DeFi side connected to the centralized order books rather than siloed.

Whether tokenized equities on an offshore crypto exchange are a good way to own equities is a separate question, and one worth asking before using them. The wrapper is not the asset, and your legal claim in a tokenized share is not the same as a share.

September 2026: A USD 387.5 Million Breach

On September 24, 2026, attackers exploited a zero-day vulnerability in a third-party security product to obtain high-level credentials for Bitget's internal network. With those credentials they issued fraudulent withdrawal instructions against the exchange's hot and warm wallets. The initial loss estimate of about USD 351.6 million was later revised to USD 387.5 million, making it the largest crypto exchange hack of 2026 and one of the ten largest ever recorded.

The mechanics matter for judging the damage. Chen stated that the attackers did not forge user withdrawal requests and did not obtain private keys for the cold, hot or warm wallets. What they compromised was the internal authorisation path, so the exchange's own systems approved transfers the exchange had not intended. Cold storage, where the majority of client funds sit, was untouched. Chen also said IP addresses and on-chain patterns matched techniques associated with North Korean state-linked groups, and that the attacker had tested risk controls with small transfers before the main theft.

No customer balance was lost. The User Protection Fund absorbed the entire amount.

What the Protection Fund Did and Did Not Prove

The fund was set up in 2022 with 5,500 BTC and a minimum commitment of USD 300 million. Covering the breach pushed it below USD 200 million. On September 28 Chen pledged to restore it above USD 300 million within a week using company capital, and by September 30 it held 3,705 BTC worth roughly USD 309 million. Proof of reserves at that point showed 131 percent overall coverage across 19 assets, with BTC at 142 percent, ETH at 110 percent, USDT at 107 percent and USDC at 154 percent.

Users voted with their balances anyway. Net outflows hit USD 463 million in the 24 hours spanning September 28 and 29, over 10 percent of reserves and the largest single-day outflow tracked at the exchange in four years. Withdrawals in BTC, ETH and USDT were restored first, with P2P, fiat and remaining tokens scheduled to resume on October 2 at 08:00 UTC.

Two conclusions follow, and they point in opposite directions.

The fund worked. A pre-funded, publicly verifiable reserve absorbed a nine-figure loss and was topped back up inside a week without socialising losses onto customers or imposing a haircut. Very few exchanges in this industry's history have handled a breach of that size that cleanly, and the ones that could not are mostly gone.

The breach also happened. A third-party dependency produced a path to internal credentials, and the authorisation controls approved transfers that should have been impossible. Cold storage held, which is the single most important fact, but the layer above it failed comprehensively. A protection fund is compensation, not prevention, and it is only as good as the operator's willingness and ability to refill it. That willingness is a commercial decision, not a guarantee, and it is worth remembering when deciding how to store crypto rather than leaving it on any exchange.

Regulation: Seychelles Today, Vienna Tomorrow

Bitget's corporate base is in the Seychelles, which is common among global derivatives venues and offers users comparatively little regulatory recourse. That is changing at the edges.

The company is building an EU headquarters in Vienna and has said the operational launch is tied to approval under the Markets in Crypto-Assets regulation, with a licence application to Austria's Financial Market Authority. A MiCA authorisation would put the European business under a supervised framework with capital, custody and disclosure requirements that the Seychelles entity does not face.

US residents are restricted, along with several other jurisdictions, and the terms of service are the authoritative list. Product availability for derivatives, Earn and tokenized assets varies by region.

What to Weigh Before Using Bitget

• Read the September 2026 breach as information, not as a disqualification. The protection fund performed exactly as designed. The infrastructure around it did not. Both facts are relevant, and an exchange that has been stress-tested in public is in some respects better understood than one that has not.
• Treat copy trading as manager selection. Vet lead traders on drawdown and duration, not headline return. A profit share with no loss exposure is an incentive to take leverage that a follower would never choose.
• Keep only working capital on the platform. This applies everywhere and it applied here. Cold storage protected the bulk of client funds; your own self-custody protects the rest.
• Understand tokenized equities before trading them. A tokenized share on an offshore venue is a contractual claim, not registered share ownership, and the difference shows up precisely when it matters.
• Leverage is where retail loses money. Derivatives depth is a feature for professionals and a hazard for everyone else. If you are still working through crypto for beginners, stay on spot.
• Check your jurisdiction, and check it again after MiCA. The Vienna entity, once licensed, will offer European users a materially different legal footing from the Seychelles parent. Which entity you contract with matters.
• Promotional programmes are not free money. Launchpool allocations and airdrops come with lockups and conditions, and social-engineering crypto scams cluster around them.

Who Bitget Suits

Bitget fits active traders who want derivatives depth, a genuinely large copy trading marketplace and broad access to altcoins alongside tokenized traditional assets, and who are comfortable with an offshore counterparty. The BGB token's fee discounts reward consistent volume, and the staking and Earn products give idle balances somewhere to sit.

It fits conservative holders considerably less well. A custodial offshore exchange that was breached for USD 387.5 million in September 2026 is not where long-term positions belong, however well the compensation mechanism performed, and the choice between trading and holding should determine where your assets actually live.

The fair summary is that Bitget is a capable, fast-moving exchange with an unusual amount of capital committed to making users whole, and it has now demonstrated that commitment under real conditions. It is also an exchange whose internal controls were defeated by a third-party zero-day, which is a reminder that the security of any custodial venue includes every vendor it depends on. Use it for what it is good at, and do not confuse a well-funded protection fund with an absence of risk.