Introduction: The Regulatory Cracks Behind a Data-Driven Success Story
In our first 50 installments, we investigated a series of exchanges ranging from HashKey to Gate. For Episode 51, we turn to a platform whose compliance narrative appears particularly contradictory: Bitget.
On paper, Bitget performs impressively across several key metrics. It has more than 125 million users worldwide, held a 6.4% market share at the end of 2025, and ranked sixth globally. It has published 47 consecutive Proof of Reserves (PoR) reports, reports an overall reserve ratio of 131%, responds to 81% of negative Trustpilot reviews, and holds a 4.6-star rating on both the Apple App Store and Google Play. From almost any angle, it looks like a major exchange that takes its operations seriously.
But there is another side to the story.
In November 2023, France‘s financial markets regulator, the Autorité des marchés financiers (AMF), placed Bitget on its blacklist, confirming that it was operating without authorization. Although its blacklist status was removed on July 9, 2026, Bitget also exited the French market around the same time. As of October 2026, Bitget is still absent from the European Securities and Markets Authority’s (ESMA) register of MiCA-authorized Crypto-Asset Service Providers (CASPs), and the MiCA transitional period ended on July 1, 2026.
WikiBit rates Bitget at 8.15/10 but flags an abnormal regulatory status for its Canadian FINTRAC registration (Registration No. M20179708), which the regulator lists as revoked. Current information also indicates that Bitget does not have valid regulatory supervision in Japan. Users should exercise caution.
In May 2026, on-chain investigator ZachXBT publicly alleged that Bitgets actual operator was its founder, Shawn Liu, while CEO Gracy Chen was merely a “figurehead.” He further alleged that the platform had long allowed scams and manipulative activities to operate behind the scenes.
Just over a month ago, on September 24, 2026, Bitget reportedly suffered a $387.5 million theft after hackers exploited a zero-day vulnerability in a third-party security product. Although the protection fund reportedly covered the losses in full and withdrawals resumed after an eight-day suspension, third-party rating firm Margin Syndicate continues to classify the incident as “RED,” citing the absence of a published root-cause investigation report.
Why would an exchange with 47 consecutive PoR reports be considered “unauthorized” by major European regulatory authorities？ And why would an exchange that responds to 81% of negative reviews be accused by an on-chain investigator of having a CEO who is merely a “figurehead”？
Lets examine the evidence layer by layer.
1. Regulatory Compliance: The Registrations Are Real, but the “EU Passport” Is Missing
Bitgets existing registrations: Genuine, but incomplete
Bitget has made some progress toward regulatory compliance. According to Coinperps‘ 2026 review, Bitget holds Digital Asset Service Provider (DASP) and Bitcoin Service Provider (BSP) licenses in El Salvador, is registered with Australia’s AUSTRAC, and has VASP registrations in several EU member states.
A background investigation by crypto-blacklist.com identifies a similar list of registrations, including a US FinCEN MSB registration, a Canadian FINTRAC MSB registration, a Lithuanian VASP registration, VASP registrations in Poland, the Czech Republic, Bulgaria, and Italy, DASP and BSP licenses in El Salvador, and registration with Argentinas National Securities Commission (CNV).
However, these registrations must be evaluated according to their actual regulatory scope.
Crypto-blacklist.com explicitly notes that most are anti-money laundering (AML) registrations or VASP registrations rather than top-tier financial licenses. An AML registration does not amount to comprehensive authorization to provide financial services.
For example, US FinCEN MSB and Canadian FINTRAC MSB registrations primarily concern AML compliance and should not be confused with full financial-services licenses. Lithuanias VASP registration belongs to the previous regulatory framework, and its continued relevance depends on the transition to MiCA.
Frances AMF: Bitget was deemed “unauthorized” and blacklisted before exiting the market
A petition submitted to the European Parliament (Petition No. 0416/2025) explicitly states that Frances financial markets regulator, the AMF, formally determined that Bitget was “not authorised,” placed it on its blacklist, and flagged it in connection with suspected fraudulent activities.
The petition also states that the Bank of Lithuania had confirmed that “Bitget Europe LT” was neither registered nor regulated.
The petitioner documented total losses of $5.6 million, including more than $260,000 in forced liquidations allegedly resulting from Bitget freezing bank accounts without justification.
An important qualification is necessary: Bitgets blacklist status was removed on July 9, 2026, and the exchange exited the French market around the same time. Removal from a blacklist should not, by itself, be interpreted as proof that the platform subsequently obtained full regulatory authorization.
MiCA: No CASP authorization, and the transitional period has ended
CASP Tracker‘s findings are direct: “Bitget does not have a MiCA (CASP) license and is not listed in ESMA’s official register,” according to a check conducted on October 1, 2026.
Bitget EU did submit an application to Austrias Financial Market Authority (FMA), and Bitget confirmed the application on July 2, 2026. But submitting an application is not the same as receiving approval.
NeoBase likewise reports that Bitget does not appear in ESMAs register of MiCA-authorized CASPs. The MiCA transitional period ended on July 1, 2026, meaning that Bitget may no longer be permitted to provide services to customers in the EU/EEA without the required authorization or another applicable legal basis.
The distinction matters: without the necessary MiCA authorization, Bitget cannot simply present itself as an EU-authorized crypto-asset service provider. Its ability to serve customers in individual European jurisdictions depends on the applicable legal framework and any valid authorization or transitional arrangements.
Australias ASIC: Promoting 125x leverage without an AFSL
On July 28, 2025, the Australian Securities and Investments Commission (ASIC) warned that entities associated with Bitget were promoting crypto futures products offering leverage of up to 125x to Australian investors without holding an Australian financial services license (AFSL).
This is a different issue from whether Bitget is registered with AUSTRAC.
AUSTRAC registration primarily concerns anti-money laundering and counter-terrorism financing obligations. An AFSL, by contrast, is a financial-services authorization relevant to the provision of regulated financial products and services. One does not automatically substitute for the other.
Corporate registration: Seychelles, another offshore jurisdiction
The Bitget group is registered in Seychelles and also has a registration in the Tbilisi Free Zone in Georgia. Its European operations have been described as having a compliance hub in Vienna.
Its restricted jurisdictions reportedly include the United States, Canada, Singapore, Hong Kong, South Korea, the Netherlands, and sanctioned countries such as Iran and North Korea. The total approaches 39 jurisdictions when certain US territories are counted separately.
Risk assessment: High risk — regulatory compliance
Bitgets registration list is real, but it is missing a crucial element: the specific authorizations required to operate legally in certain major markets.
In the European Union, MiCA CASP authorization is central to whether a crypto-asset service provider can legally serve customers under the EU framework. In Australia, an AFSL is relevant to whether an entity can lawfully provide or promote certain regulated financial products and services.
Bitget has faced an AMF determination that it was unauthorized in France, remains absent from ESMAs MiCA-authorized CASP register, and was warned by ASIC over the promotion of leveraged products without an AFSL.
These are not merely questions about whether one license is more prestigious than another. They raise a more fundamental issue: Does the platform have the legal authorization required to serve customers in major developed markets？
For users, that distinction is critical. A registration in one jurisdiction does not automatically authorize an exchange to operate everywhere, and a high reserve ratio cannot compensate for missing regulatory permissions.
2. Account Security and Withdrawals: The $387.5 Million Hack — The Largest Crypto Theft of 2026
$500,000 in profits, but only $50,000 in principal allowed to be withdrawn
In July 2026, a user's account of their experience on the Chinese complaint platform Zebra Complaints was picked up and reported by multiple Chinese-language media outlets.
User A deposited 50,000 USDT into Bitget. After trading, the account balance grew to 552,510 USDT. However, after making a profit, the user was reportedly allowed to withdraw only the original 50,000 USDT deposit, while the remaining balance of more than $500,000 could not be withdrawn.
The account was subsequently restricted from logging in, with a notification stating that the account was considered risky.
Customer support alleged “abnormal trading, market manipulation, and violations of the terms of use,” and reportedly threatened to permanently ban the account and suspend withdrawals. However, the platform allegedly provided no specific order-level evidence and did not identify which trades had violated which particular provisions.
“You make money, but you can only get your principal back. The profits belong to the platform.”
This is one of the most troubling patterns appearing in Bitget user complaints.
“Pay £4,920 to unlock your account”
One Trustpilot reviewer described an even more extreme experience:
“When I attempted to withdraw, Bitget froze my account without any warning and demanded £4,920 to unlock it — either pay up or lose access to your funds.”
A demand for payment to unlock an account resembles complaint patterns reported in connection with platforms such as KCEX, Biconomy, and LBank.
These allegations require independent verification. A reviewer's account alone does not establish that the platform deliberately withheld funds or that the requested payment was fraudulent. Nevertheless, demands for additional payments as a condition of releasing funds warrant particular scrutiny.
Trustpilot: 1.7/5, with 75% one-star reviews
At the time of the cited data, Bitget had a Trustpilot rating of 1.7/5 based on 1,695 reviews. Approximately 75% were one-star reviews, while only 14% were positive.
Bitget's official Trustpilot profile states that the company responds to 81% of negative reviews, typically within one week.
An 81% response rate is a positive operational indicator. But responding to a complaint is not the same as resolving it.
Reports involving withdrawals restricted to the original principal despite substantial profits, a purported £4,920 account-unlocking fee, and profits allegedly withheld even after users submitted questionnaires seven or eight times suggest that a high response rate does not necessarily mean every dispute has been resolved to the user's satisfaction.
If the withdrawal complaints above represent individual cases of friction with risk-control procedures, the incident of September 24, 2026, points to a much more serious, platform-wide security failure.
The September 24, 2026, hack: $387.5 million in stolen assets
Scale of the loss: Following detailed reconciliation by the relevant official parties, blockchain security firm SlowMist, and Google-owned Mandiant, the total amount of stolen assets was reportedly finalized at $387.5 million, up from an initial estimate of $351.6 million.
The stolen assets reportedly included major tokens such as ETH, XRP, BNB, AVAX, and USDT across 11 blockchains. This was described as the largest cryptocurrency theft worldwide in 2026.
Attack method: A supply-chain vulnerability that bypassed private-key theft.
According to the reported investigation, the attackers did not directly steal wallet private keys. Instead, they exploited a zero-day vulnerability in a third-party security product used within Bitget's wallet infrastructure.
The attackers allegedly obtained privileged internal credentials, infiltrated the backend management system, and forged transfer and withdrawal instructions. The system reportedly recognized these forged instructions as legitimate administrative operations, allowing the attackers to bypass existing risk-control measures and drain assets from some hot and warm wallets.
Following the incident, Bitget urgently suspended platform withdrawals to isolate the affected systems, while deposits and trading reportedly continued operating normally.
The platform did not complete its phased security restoration for withdrawals until October 2, 2026.
Bitget subsequently issued an official statement through CEO Gracy Chen, emphasizing that its cold wallets had not been affected and that users' account balances remained secure. The losses, amounting to hundreds of millions of dollars, were reportedly covered in full by Bitget's own reserves and its $464 million User Protection Fund. The company later used its own capital to replenish the fund to more than $300 million.
The $380 million-plus incident directly contributed to a sharp, short-term deterioration in Bitget's market confidence, the amount of capital held on the platform, and its trading-volume rankings toward the end of September 2026.
Risk assessment: High risk — account security and withdrawals
The distinction between a fully reimbursed security incident and a harmless incident is important. Reimbursement can reduce users' realized losses, but it does not erase the underlying security failure.
Likewise, a platform's ability to restore withdrawals and replenish a protection fund is reassuring, but users should still consider the vulnerability's root cause, the scope of the investigation, and whether independent verification confirms that the underlying weaknesses have been addressed.
3. Proof-of-Reserves Transparency: This Is One Area Where Bitget Has Delivered
PoR data: 47 consecutive reports and a 131% reserve ratio
Among the high-risk exchanges examined in this series, Bitget performs relatively well in terms of reserve transparency.
According to Bitget's official announcements, the exchange began publishing Proof of Reserves (PoR) reports in December 2022 and has continued publishing them monthly. As of October 2026, it had released 47 consecutive PoR reports, with the latest report showing an overall reserve ratio of 131%, above the 1:1 benchmark.
On September 29, 2026, Bitget expanded its PoR coverage from four assets to 19. These include BTC, USDT, ETH, LTC, LINK, XRP, USDC, DOGE, BNB, SOL, ADA, NEAR, XAUT, TAO, SUI, ONDO, HYPE, PI, and USDGO.
Bitget uses Merkle Tree technology to aggregate and verify user assets. Users can independently check whether their holdings were included in a particular PoR snapshot and download relevant data for further verification using publicly available methods.
CEO Gracy Chen stated in an official announcement: “Users shouldn't just take our word for it; they should be able to verify their assets themselves.”
But the limitations of PoR must be clearly understood
First, PoR addresses whether assets cover liabilities; it does not guarantee smooth withdrawals.
The user who allegedly made more than $500,000 in profits but could withdraw only the original principal might still have had an account balance included in a PoR snapshot showing 131% coverage.
Whether Bitget allows a particular user to withdraw profits is a separate issue from the exchange's aggregate reserve ratio.
Second, PoR covers 19 assets, while Bitget supports a much wider range of tokens.
Bitget's official announcements state that the platform serves more than 125 million users and provides access to over two million crypto tokens. Transparency covering 19 assets does not establish the reserve position of every asset available on the platform.
Third, PoR is a snapshot, not continuous auditing.
The 131% figure reflects a particular point in time. An exchange could have reserves equal to 131% of its covered liabilities at the time of a snapshot and still restrict withdrawals afterward.
The scope and methodology of a PoR report also matter. A reserve ratio should not automatically be interpreted as proof that all liabilities have been independently audited, that every asset is unencumbered, or that the platform has sufficient liquidity under all market conditions.
Risk assessment: Low risk — PoR transparency only
Bitget deserves credit for its PoR practices: 47 consecutive reports, coverage of 19 assets, and Merkle Tree-based user verification. These are meaningful strengths that should be acknowledged objectively, even in an investigation focused on platform risks.
However, the limits are equally clear: PoR can provide evidence that a platform holds sufficient assets against the liabilities covered by the report. It does not guarantee that your money can always be withdrawn, nor does it establish that you have legal protection when using the platform in the European Union.
4. Financial Strength and Trading Depth: Trading Volumes Contract Sharply in 2026
The impressive headline figures
Founded: 2018
Global users: More than 125 million, according to Bitget's 2026 figures
Market share at the end of 2025: 6.4%, ranking sixth globally, according to CoinGecko data
Year-over-year trading-volume growth in 2025: 45.5%
App Store and Google Play ratings: 4.6 stars on both platforms
Google Play downloads: More than 10 million
Total platform assets: Approximately $7.25 billion, according to third-party estimates
These figures suggest that Bitget entered 2026 as a substantial player in the centralized exchange market.
But trading activity has contracted significantly in 2026
CoinMarketCap Research's September 2026 Crypto Exchange Monthly Report put Bitget's spot trading volume at approximately $27.9 billion and its derivatives trading volume at approximately $230.9 billion, for a combined total of around $258.9 billion.
Bitget's reported monthly trading volume fell from approximately $833 billion in 2025 to $258.9 billion in September 2026, a decline of 68.9%.
However, trading activity across the centralized exchange market also contracted. Bitget's decline should therefore be evaluated against the broader market rather than automatically interpreted as evidence of exchange-specific financial distress.
Its share of global trading has nevertheless declined
First quarter: Fifth place, with a 7.7% market share
According to CoinGlass's first-quarter 2026 crypto market-share research, Bitget ranked fifth among global exchanges by combined spot and derivatives trading volume, accounting for 7.70% of total industry volume.
Third quarter: Monthly rankings slipped to eleventh place
According to figures attributed to CoinDesk Research and Datawallet's 2026 cryptocurrency statistics reports, the market slowdown in mid-2026, together with the impact of security incidents, coincided with a decline in Bitget's reported monthly trading activity.
The cited figures show trading volume falling from approximately $37.8 billion in June to below $19 billion in July and August. Bitget also reportedly dropped out of CoinGecko's top 10 by spot and overall trading volume at one point, falling to 11th place.
These figures need to be interpreted carefully because exchange rankings vary according to the methodology, trading pairs, time period, and whether the data cover spot markets, derivatives, or both. The monthly figures should not be directly equated with the combined spot and derivatives totals reported for September without confirming that the underlying datasets use comparable definitions.
A decline in trading volume and market share can affect fee revenue, market depth, and the platform's competitive position. However, neither metric alone establishes insolvency or an imminent risk of an exchange exit.
Risk assessment: Medium risk — financial strength and trading depth
Bitget remains a major exchange with a substantial user base, a broad product offering, and significant reported assets. Its scale is an important source of resilience.
Nevertheless, the contraction in trading activity and decline in relative market share warrant monitoring. For users, the practical questions are whether liquidity remains adequate for their trading pairs, whether large orders can be executed without excessive slippage, and whether withdrawals remain reliable during periods of market stress.
Bottom line: Bitget's financial scale and PoR transparency are meaningful strengths, but neither should be treated as a guarantee against security failures, withdrawal disputes, or regulatory restrictions.
5. Internal Operations and Team: ZachXBT Claims the “CEO Is a Figurehead, While the Real Boss Operates Behind the Scenes”
This is the most significant controversy surrounding Bitget's leadership and governance
In May 2026, blockchain investigator ZachXBT publicly named Bitget founder Shawn Liu (Liu Xuewu) on X, identifying him as the exchange's actual operator and the “big boss,” while describing CEO Gracy Chen as “only the face of it.”
ZachXBT's exact words were: “Shawn Liu is the big boss of Bitget, allowing these scams to run behind the scenes, while Gracy Chen is only the face of it.”
He also accused Bitget of benefiting from suspicious activities over an extended period.
ZachXBT further argued that Bitget should freeze the profits market makers earned through these allegedly manipulative trades and compensate affected users.
He cited the LAB token as an example. In early May 2026, LAB's price surged by more than 350% over a 72-hour period before plunging by more than 65%–84% within the following hours.
According to transaction tracking by Lookonchain and Arkham, between May 11 and 12, ten newly created wallets with no prior trading history collectively withdrew 100 million LAB tokens from Bitget's hot wallets over a 12-hour period. The tokens were reportedly worth approximately $480 million at the time, representing 32.26% of the circulating supply.
ZachXBT characterized the pattern of large transfers from the exchange to mysterious new wallets during the price collapse as evidence of coordinated dumping and market manipulation involving insiders and malicious market makers.
These allegations are serious. However, wallet transfers and unusual price movements do not, by themselves, establish that Bitget insiders and market makers coordinated the activity. The interpretation requires corroborating evidence, including wallet ownership attribution, transaction counterparties, and a verified account of the events.
Publicly disclosed leadership: Gracy Chen is CEO, while the founder has stepped back from the spotlight
Bitget's publicly identified CEO is Gracy Chen, who previously held a management position at Taipei-based virtual reality company XRSPACE before joining Bitget.
Another individual associated with the company's founding and business operations is Henri Chen, a Singaporean with a background in finance and engineering from the University of Melbourne. He reportedly worked at Royal Bank of Scotland and JPMorgan before stepping back from public-facing responsibilities.
Industry interviews published in Chinese-language media in 2023 described former or current employees' perceptions of his management style as forceful, decisive, and highly results-oriented.
However, the relationship between the “Shawn Liu” named in ZachXBT's allegations and Henri Chen, who appears in publicly available information, is not entirely clear from the information cited here.
The central issue is therefore not simply whether the names match. It is whether there is a meaningful gap between Bitget's publicly presented leadership and the individuals who actually exercise decision-making authority.
ZachXBT's allegations raise the possibility of a governance structure in which the public-facing CEO and the alleged behind-the-scenes decision-maker are not the same person.
This resembles a broader category of governance-transparency concerns seen at other exchanges, including questions about the verifiability of MEXC's “Ryder Junji” identity and the lack of publicly verifiable LinkedIn information for BingX's founder. The circumstances differ, but the underlying question is similar: Can users independently establish who actually controls the exchange and makes its critical decisions？
Unlike cases where the identity of a leader is simply difficult to verify, Bitget's controversy concerns the alleged separation between its publicly visible executive leadership and its actual decision-making structure.
The August 2026 oracle anomaly: Potential weaknesses in risk controls and product design
On August 9, 2026, three Bitget perpetual futures contracts—TUT, LOBSTER, and BICO—reportedly experienced abnormal price movements. Their mark prices diverged from their index prices, triggering forced liquidations.
Bitget confirmed that it would compensate affected users in USDT. However, a VIP trader subsequently disputed the proposed compensation in a Trustpilot review, claiming losses of approximately 47,000 USDT across three linked accounts, compared with an initial compensation offer of only 9,600 USDT.
Another complaint involving COTI liquidations concerned a sudden price spike, or “wick,” in the mark price. The trader alleged that the position was liquidated even though the last traded price remained above the stop-loss level.
Bitget customer support reportedly confirmed that liquidation decisions were based on the mark price. Consequently, stop-loss orders tied to the last traded price could fail to protect positions during an abnormal oracle-driven mark-price movement.
This highlights an important distinction in derivatives trading: the last traded price, index price, and mark price serve different purposes. When the mark price is used to determine liquidation, a stop-loss based on the last traded price may not prevent liquidation during a sharp divergence.
Such incidents do not automatically demonstrate insolvency or deliberate misconduct. However, they raise legitimate questions about oracle resilience, liquidation mechanisms, compensation policies, and whether users adequately understand the risks embedded in the platform's contract design.
Risk assessment: High risk — team and governance
ZachXBT's allegations are public, identify specific individuals, and refer to concrete market events. Nevertheless, allegations should not be treated as proven facts without independent corroboration, and the relationship between Shawn Liu and Henri Chen remains unclear based on the information cited here.
Regardless of whether Bitget has responded to these allegations, the controversy highlights a structural concern: there may be insufficient transparency regarding the relationship between its public leadership and its actual decision-makers.
For a platform managing more than 125 million users and billions of dollars in assets, “Who is really making the decisions？” should not be a question that users need an on-chain investigator to answer.
6. Community Feedback: A 4.6-Star App Rating vs. 1.7 on Trustpilot — Two Very Different Worlds
An extreme divide in user sentiment
| Platform | Rating | What the feedback may reflect |
| Apple App Store | 4.6/5 | Fast execution, comprehensive trading tools, and a smooth interface |
| Google Play | 4.6/5, approximately 331,000 reviews | Positive trading experience; more than 10 million downloads |
| Trustpilot | 1.7/5, approximately 1,700 reviews; only 14% positive | Withdrawal freezes, withheld profits, unexplained account restrictions, and alleged payment demands to unlock accounts |
A review published by jb51.net accurately summarizes this divide:
“The app and trading functions are genuinely good, and that is its strongest selling point. Fast execution and comprehensive trading tools are repeatedly mentioned in positive reviews. Routine trading and chart analysis feel smooth. But Trustpilot continues to highlight the biggest risk. Most serious complaints begin during withdrawals or disputes, when users have no regulatory authority in their country or region to escalate the matter to.”
The figures and review summaries above reflect the cited data and should be checked against the platforms' latest listings, as ratings and review counts change over time.
“Smooth trading, nowhere to turn when things go wrong”
This captures the central contradiction in Bitget's reputation.
Users who have never encountered withdrawal problems may appreciate the platform's trading tools, execution speed, and interface. But when an account triggers risk controls or a withdrawal review, the experience can be very different.
Some complaints describe a customer-support system with a high response rate but limited transparency regarding the specific evidence of alleged violations, the contractual provisions invoked, or the steps required to release funds.
A distinction is important here: negative reviews do not establish that every complaint is valid, and app-store ratings do not independently verify an exchange's financial or regulatory condition. The platforms also attract different types of users and may reflect different experiences.
Nevertheless, the sharp gap between the app-store ratings and Trustpilot score is a meaningful signal that warrants further investigation, particularly when the negative feedback repeatedly concerns access to funds rather than ordinary trading performance.
Risk assessment: High risk — community feedback
Bitget appears to deliver a relatively strong day-to-day trading experience for many users. However, the concentration of serious complaints involving withdrawals, account restrictions, and unresolved disputes raises concerns about what happens when users encounter problems.
A smooth trading experience is not the same as reliable access to your money. Before depositing substantial funds, users should evaluate not only trading functionality but also withdrawal reliability, dispute-resolution procedures, regulatory recourse, and the transparency of account restrictions.
7. Comprehensive Exchange Exit Risk Assessment
| Category | Risk Level | Summary |
| Regulatory compliance | High | France's AMF determined that Bitget was unauthorized and placed it on its blacklist; Bitget subsequently exited the French market. No MiCA CASP authorization, with the transitional period having ended. ASIC warned that Bitget-related entities promoted derivatives without an AFSL. The Bank of Lithuania reportedly confirmed that “Bitget Europe LT” was unregistered. |
| Account security and withdrawals | High | A user reportedly made over $500,000 in profits but was allowed to withdraw only the original principal. Another complaint alleged a £4,920 account-unlocking fee. The $387.5 million hack was reported as the largest crypto theft of 2026. |
| Proof-of-Reserves transparency | Low | 47 consecutive PoR reports, a 131% overall reserve ratio, 19 covered assets, and Merkle Tree-based self-verification. |
| Financial strength | Medium | A 6.4% global market share and sixth-place ranking were reported at the end of 2025, but monthly trading volume reportedly fell 68.9% from its 2025 average to September 2026. The platform reports more than 125 million users. |
| Team and operations | High | ZachXBT alleged that the CEO was a “figurehead” and that Shawn Liu was the real power behind the scenes. Oracle-related price anomalies in August 2026 triggered liquidation disputes. |
| Product experience | Medium | App ratings of 4.6/5 and reportedly fast execution. However, the experience can deteriorate sharply when withdrawal reviews or risk-control procedures are triggered. |
| Community feedback | High | Trustpilot rating of 1.7/5 versus app-store ratings of 4.6/5. The central concern: “Smooth trading, nowhere to turn when things go wrong.” |
Overall rating: High exchange exit risk
Bitget is one of the most contradictory cases in this series. It combines apparently diligent operations with regulatory gaps, strong PoR transparency with serious withdrawal complaints, and sophisticated trading functionality with concerns about governance and post-incident customer support.
Its risk profile has six defining characteristics.
1. Its regulatory gaps are structural, not merely technical details.
France's AMF determined that Bitget was unauthorized and placed it on its blacklist before its status was removed and the exchange exited the French market. Bitget remains absent from ESMA's register of MiCA-authorized CASPs, the MiCA transitional period has ended, and ASIC has warned about the promotion of derivatives without an AFSL.
These are not simply questions about the relative prestige of different licenses. They concern whether the platform has the legal authorization required to serve customers in the EU and Australia.
Bitget's Salvadoran DASP license and AUSTRAC registration are genuine regulatory credentials, but they do not substitute for MiCA CASP authorization or an AFSL where those authorizations are required.
2. Withdrawal complaints suggest a recurring pattern in which profits trigger risk controls.
Reports involving more than $500,000 in profits allegedly being withheld while the original principal was released, a purported £4,920 unlocking fee, and profits allegedly withheld after repeated questionnaire submissions share a troubling feature: users claim that access to their funds became problematic after they made money.
The platform reportedly cited abnormal trading or market manipulation in some cases, but the complainants said that specific evidence and contractual grounds were not adequately disclosed.
These remain allegations rather than independently established findings. Nevertheless, the recurrence of similar complaints warrants scrutiny of the platform's withdrawal-review procedures, evidence standards, and dispute-resolution mechanisms.
3. Bitget is a strong PoR performer, but the limits are clear.
Forty-seven consecutive reports, a 131% reserve ratio, coverage of 19 assets, and Merkle Tree-based verification are meaningful strengths that deserve objective recognition.
But PoR demonstrates reserve coverage for the assets and liabilities included in a report. It does not establish that users have legal protection in the EU, nor does it guarantee that every profitable position can be withdrawn without restriction.
4. ZachXBT's “figurehead” allegation raises a central governance concern.
Regardless of the relationship between Shawn Liu and Henri Chen, the possibility that the public-facing CEO and the actual decision-maker may be different people deserves serious attention.
For a platform serving more than 125 million users, identifying who exercises effective control should not require an on-chain investigator to piece together the answer.
The allegation remains unproven based on the information discussed here, but the underlying question of leadership transparency is legitimate.
5. “Smooth trading, nowhere to turn when things go wrong” captures the central reputational divide.
The difference between a 4.6-star app rating and a 1.7-star Trustpilot rating does not necessarily mean that one group of reviewers is lying. The platforms may reflect different aspects of the user experience.
Routine trading may be smooth and efficient. However, when users need customer support or face risk-control reviews, some report a dramatic deterioration in their experience. In many users' jurisdictions, they may also lack a readily accessible local regulator to escalate complaints to.
6. The September 24, 2026, security incident exposed a serious platform-level vulnerability.
The reported $387.5 million theft was described as the largest cryptocurrency theft of 2026. Although Bitget reportedly covered the losses and restored withdrawals, the incident represents a major security concern that should not be dismissed simply because users were reimbursed.
This is not merely a question of whether Bitget has a high risk of suddenly disappearing. It is a question of how users should evaluate a major exchange that has substantial PoR transparency and strong trading functionality, yet faces questions about regulatory authorization, withdrawal controls, and an alleged gap between its public-facing leadership and behind-the-scenes decision-makers.
8. Recommendations for New and Existing Users
For new users
1. Approach the platform cautiously.
Bitget is not an obviously dubious operation of the kind that might be dismissed at first glance. It has 47 consecutive PoR reports, a substantial global market share, and app ratings of 4.6/5.
But the reported $387.5 million hack in September 2026, the absence of MiCA CASP authorization, and complaints involving users who allegedly could withdraw only their principal despite making substantial profits raise three separate concerns.
Are you comfortable accepting those risks before depositing funds？
2. If you are in the EU or Australia, check the regulatory position first.
Bitget does not appear in ESMA's register of MiCA-authorized CASPs, and ASIC has warned about the promotion of derivatives without an AFSL.
The MiCA transitional period has ended. Depending on your jurisdiction, the services offered, and any applicable legal arrangements, the platform may not have the local authorization required to serve you.
Verify the current regulatory status with the relevant official authority before opening an account or transferring funds.
3. If you still decide to try it, test the complete process with a small amount.
Follow the entire sequence:
Deposit → Trade → Withdraw.
Pay particular attention to withdrawals. Start with a small withdrawal and confirm that the process works before considering a larger deposit.
The reported case involving more than $500,000 in profits illustrates the potential consequences of a withdrawal dispute after substantial gains. It does not establish that the likelihood of a dispute necessarily increases with the amount, but the financial consequences can be much greater when larger balances are involved.
4. Do not keep emergency savings or long-term accumulated profits on the platform.
Withdrawal reviews and account restrictions are a genuine concern raised by user complaints. The evidence and contractual grounds behind some reported restrictions have also been disputed.
Keep only funds you can afford to put at risk, withdraw profits periodically, and avoid leaving substantial balances on the exchange simply because you intend to withdraw everything once you reach a particular profit target.
For existing users
1. Review your exposure.
If more than 20% of your total assets are held on Bitget, consider gradually reducing that concentration or diversifying across independently assessed custody and trading arrangements.
This is not a prediction that the exchange will fail tomorrow. It is a precaution in light of the combination of regulatory uncertainty, disputed withdrawal controls, and reported trading-volume contraction.
The 20% threshold is a personal risk-management guideline, not a universally applicable financial rule.
2. Do not wait until you have accumulated a large profit before testing withdrawals.
The reported case in which a user could withdraw only the original principal despite substantial profits highlights the importance of testing withdrawal access before a large balance builds up.
Withdraw profits periodically and avoid keeping substantial unrealized gains or excess trading capital on the platform indefinitely.
3. Preserve all relevant evidence.
The user who reported more than $500,000 in withheld profits was able to document the complaint with deposit records, trading records, and customer-support screenshots.
If you encounter withdrawal problems, preserve:
Deposit and withdrawal records.
Order histories and transaction IDs.
Customer-support emails and chat logs.
Screenshots of account restrictions and the reasons provided.
Login notifications and relevant device-access records.
Any notices citing specific terms of service or alleged violations.
If a dispute escalates, a complete timeline and contemporaneous records may help support a complaint to the relevant regulator or other appropriate authority.
4. Monitor PoR, but do not treat it as a guarantee.
Bitget's PoR program is substantial, ongoing, and technically meaningful. However, it demonstrates reserve coverage within the scope of the published report—not guaranteed withdrawal access, legal authorization in every jurisdiction, or the absence of all financial risks.
An exchange reporting a 131% reserve ratio can still restrict withdrawals because of risk controls, technical failures, compliance reviews, or other disputes.
5. Follow developments concerning ZachXBT's allegations.
Monitor whether Bitget or Shawn Liu issues a substantive public response and whether additional independently verifiable on-chain evidence emerges.
Such developments could materially change the assessment of who exercises effective control over the platform and how transparently its leadership operates.
Final recommendations: Who might consider Bitget, and who should be especially cautious？
Potentially suitable, subject to jurisdiction and risk tolerance:Experienced traders who understand copy trading and derivatives, can tolerate substantial volatility, and use strict position sizing and withdrawal discipline.
Less suitable:
Beginners who are unfamiliar with exchange, custody, and withdrawal risks.
Users who were already alarmed by the September withdrawal disruption and are uncomfortable with unresolved security questions.
Investors holding large amounts of stablecoins for long-term storage.
Users who have zero tolerance for exchange security incidents.
Customers who require clear local regulatory protection and straightforward dispute escalation.
Bitget's position is deeply divided.
When it comes to demonstrating that it holds assets, it has made a substantial effort: 47 consecutive PoR reports, a 131% reserve ratio, and 19 covered assets.
When it comes to demonstrating its regulatory status, significant gaps remain: it is absent from ESMA's MiCA-authorized CASP register, and ASIC has raised concerns about the lack of an AFSL for certain derivatives-related activities.
When it comes to trading functionality, the platform appears competitive: its apps are rated 4.6/5, and it reported a 6.4% global market share at the end of 2025.
But when something goes wrong, some users describe a very different experience: “Smooth trading, nowhere to turn when things go wrong.”
The September 2026 hack, with reported losses of $387.5 million, is a major security red flag. ZachXBT's allegations also raise a fundamental governance question: the CEO users see in public may not be the person making the most important decisions behind the scenes.
Imagine an exchange with a highly efficient trading system and a willingness to publish its reserve data.
You ask, “Do you have the required license in the EU？” The answer points to a registration in El Salvador.
You ask, “Why can I withdraw only $50,000 when I made more than $500,000 in profits？” The response reportedly alleges a violation but, according to the complainant, does not clearly identify the specific rule or evidence.
You ask, “Who is actually in charge？” An on-chain investigator alleges that the person in the public spotlight is merely a figurehead.
That is the contradiction at the heart of the Bitget risk assessment: impressive reserve transparency and trading functionality do not, on their own, resolve concerns about regulatory authorization, withdrawal access, security, or governance.
Coming Next
WikiBit Exchange Exit Risk Rankings #52: Bybit
Stay tuned for our next investigation.
Risk Disclaimer: This article reflects the author's analysis and opinions and does not constitute investment advice. Cryptocurrency investments involve substantial risks. Conduct your own research and exercise caution before investing.
Information current as of October 29, 2026. Please cross-check the latest information against multiple reliable sources, including official regulatory records and exchange disclosures.
WikiBit is an exchange regulatory information platform used and supported by over 1 billion crypto investors. Explore real-time regulatory information on cryptocurrency exchanges anytime. Download WikiBit here:https://wikibit.onelink.me/wgfF/1b1dn69b
