Crypto exchange Bitget is cutting off some of its users. The company announced on X on Saturday, October 17 that it will stop serving certain customers in what it called a one-off exercise, promising that their funds remain safe while the platform keeps running. Users who are affected get direct notice — email, in-app message, or push notification — with their own deadlines and withdrawal instructions. Anyone who has not received a notice keeps trading normally.
The real story is who gets cut. Bitget updated its terms of use on October 16 to add Russia and Belarus to its prohibited-countries list, joining Kazakhstan (added earlier this year) and already-barred markets including the United States, Canada, Japan, Singapore and Hong Kong. People from those jurisdictions count as "restricted" persons — the exchange can restrict or end their access at any time, close open positions, and limit withdrawals. Some users already report getting termination emails telling them to withdraw all assets. One affected user cited in The Defiant's reporting was given an October 21 deadline. Bitget's support account pointed to country restrictions and regulatory compliance when asked.
That is a fast turnaround from the hack that defined Bitget's September. On September 24, the exchange detected unauthorized transfers from parts of its hot and warm wallets at about 18:31 UTC and froze all withdrawals while trading and deposits stayed open. The amount moved was first estimated at $351.6 million, later raised to roughly $387.5 million. CEO Gracy Chen said in a September 28 AMA that the attacker exploited a flaw in an outside security vendor's product to pull high-level internal credentials and fabricate withdrawal instructions. Private keys were not leaked and cold wallets were untouched.
Withdrawals reopened in stages — bitcoin on September 28, ether and USDT in the following days, everything else by October 2.
Why it matters
For traders, the practical question is access, not price. Bitget's terms let it end a restricted user's access, force-close positions and limit withdrawals on its own say-so — and nobody outside the exchange knows how many accounts this sweep covers. The company framed the cutoff as a single exercise rather than an ongoing purge. Still, anyone trading from Russia, Belarus or Kazakhstan should treat the October 21-style deadline as real and move funds before the cutoff, not after.
The numbers explain why this month's compliance push is getting attention. The $387.5 million September loss ate roughly 83% of the $464 million user protection fund the exchange says will cover the damage — one incident, most of the backstop. Per CertiK data, the Bitget incident alone made up about 31% of the $1.26 billion in crypto security losses recorded in Q3 2026, which was up almost 54% from Q2. A hack that size brings auditors, partners and regulators closer — and exchanges under that kind of scrutiny tend to tighten their jurisdiction lists.
What to watch
- Withdrawal deadlines: notices are account-specific, and at least one cites October 21 — watch for the first locked-account reports after cutoffs land.
- Whether the purge stays "one-off": the terms let Bitget restrict anyone at any time, so the question is whether more jurisdictions or accounts get swept later.
- The protection fund: valued above $464 million and said to cover the loss — any sign of a top-up or changed valuation would show what the September hit really cost.
- Copycat moves: after the OKX-ICE tokenized-stock venue saw nine companies opt out before launch this same week, compliance pressure is tightening across crypto venues.
Key points
| Unauthorized transfers detected | Sept 24, ~18:31 UTC | Hot/warm wallets hit; withdrawals frozen |
|---|---|---|
| Terms updated | Oct 16 | Russia and Belarus added to prohibited list |
| One-off service cutoff announced | Oct 17 | Affected users get direct notices with deadlines |
| Reported deadline (one user) | Oct 21 | Per user report to The Defiant |
- Certain users lose service in this one-time cleanup; affected accounts get direct notice with their own deadlines.
- Russia, Belarus and Kazakhstan are now on the prohibited list, alongside the US, Canada, Japan, Singapore and others.
- The September hack drained roughly $387.5 million — about 83% of the exchange's stated $464 million protection fund.
- That incident was the biggest single contributor to Q3 2026's $1.26 billion in crypto security losses, per CertiK.
MarketRadar take
This is an exchange-risk story, not a price story. Bitcoin sat at $81,625 on Saturday morning, down 0.58% on the day, and ether at $2,433 — nothing in the tape suggests the market is pricing a Bitget contagion. The exchange says balances are unaffected, cold wallets were never touched, and the platform keeps operating, so this reads as a compliance cleanup after the worst month in the exchange's recent history. The one number to keep on the watchlist: $387.5 million against a $464 million protection fund leaves thin margin if anything else goes wrong.
