Bitget ends services for some users, adds Russia and Belarus to prohibited list

Bitget said on Oct. 17 it will stop serving some of its users. In a post on its official X account at 2:17 p.m. KST, the exchange said: "While the Bitget platform continues to operate, we have made the decision to discontinue services for certain users." Bitget called the move "a one-off exercise for certain users only" and said user funds remain safe.

The exchange did not say how many users are affected or where they are based. A day earlier, however, Bitget updated its Terms of Use, dated Oct. 16, adding Russia and Belarus to its list of "Prohibited Countries."

Notices by email and app, deadlines set per account

According to Bitget, affected users will receive direct notifications by email, in-app message and/or push notification setting out the next steps, relevant deadlines and withdrawal arrangements. "Please refer to your notification for details specific to your account," the exchange said, adding that its customer support team will help with withdrawals and pending orders.

Users who were not notified can keep using their accounts. "For users who did not receive an official notification from Bitget, you can continue to use your account as usual, subject to the platform terms and conditions," the company said. Bitget also said it "continues to be committed to its users and will continue its global growth." The post ended with a security reminder to rely only on Bitget's official channels for the latest information.

Two countries missing from the Sept. 15 terms

Bitget's Terms of Use define Prohibited Countries as locations the company designates from time to time. The Oct. 16 list includes Russia and Belarus alongside the United States, Canada, Japan, Hong Kong, Singapore, France, Germany, Austria, Malaysia, Thailand, Kazakhstan, North Korea and Iran, among others.

The terms treat not only individuals residing in prohibited countries but also entities established or operating there as restricted. They also allow the company to close accounts and liquidate positions. Bitget did not explain how the service termination relates to the terms update. South Korea does not appear on the prohibited list in either version.

Three weeks after a $387.5 million hack

The announcement came a little more than three weeks after a major security breach. Bitget detected unauthorized transfers from some of its hot wallets (wallets connected to the internet) at 6:31 p.m. UTC on Sept. 24 and suspended withdrawals. It initially put the loss at about $351.6 million, then revised it to $387.5 million the next day after including Zcash and Tron assets. The company said the revised figure reflected a more complete accounting of the losses, not additional theft.

CEO Gracy Chen said the loss falls within the coverage of Bitget's User Protection Fund, which holds more than $464 million. Cold wallets (wallets kept offline) were not affected. Withdrawals reopened in stages, starting with bitcoin on Sept. 28, followed by ether on Sept. 29, Tether (USDT) on Sept. 30, and other tokens, fiat services and peer-to-peer trading on Oct. 2.

In a Sept. 28 post on X, Bitget said a flaw in a third-party security product gave the attacker high-level internal credentials, which were used to send fraudulent withdrawal commands that bypassed its risk controls. It said private-key compromise had been ruled out based on the investigation to date. Security firms Mandiant and SlowMist are assisting the investigation, and law enforcement has been notified. Bitget did not link the service termination to the hack.

Bitget's exchange token BGB is not listed on the Korean won markets of South Korean exchanges Upbit or Bithumb. At around 10:30 p.m. KST on Oct. 17, BGB traded at $1.899 on Bitget's spot market, down 2.4% over 24 hours.