Bitget, Liquid and the Q3 2024 Crypto Hack Wave
Bitget and Liquid exploits were among the Q3 2024 crypto hacks that reportedly pushed total exchange losses to roughly $1.2 billion, with supply chain and infrastructure weaknesses accounting for about 77 percent of losses, per Cointelegraph's reporting, a case still cited when traders vet exchange security in 2026.
Bitget and Liquid were among the exchanges named in connection with a rough stretch for crypto security in the third quarter of 2024, when hacks and exploits across the industry totaled roughly $1.2 billion, according to Cointelegraph’s reporting. Supply chain and infrastructure vulnerabilities, rather than simple password theft or phishing, accounted for about 77% of that total, the same reporting found. More than a year on, the episode is still a useful reference point for traders trying to figure out which platforms take custody and infrastructure security seriously heading into 2026.
This is a news analysis, not a breaking update: the underlying hack data comes from Q3 2024, and we’re revisiting it because the pattern it describes, attackers going after vendors and infrastructure rather than exchanges’ own front-end code, has only become more relevant since. If you’re deciding where to keep funds in 2026, the lesson isn’t really about Bitget or Liquid specifically. It’s about what kind of attack surface every exchange carries, and how to check for it before you deposit.
What Cointelegraph’s Q3 2024 Data Actually Showed
The reporting framed the quarter as a reminder that exchange security isn’t just about an exchange’s own smart contracts or hot wallet practices. When nearly four-fifths of losses trace back to supply chain and infrastructure weaknesses, that points to a different kind of risk: the vendors, open-source libraries, cloud configurations, and third-party signing tools that sit underneath the platform you actually log into. Bitget and Liquid were cited as contributors to that total, though the available reporting doesn’t break out a precise, individual dollar figure for either exchange, and we’re not going to invent one here.
It’s worth being precise about what this does and doesn’t mean for either exchange today. A hack contributing to an industry-wide total in a specific quarter is not the same as an exchange having collapsed, lost its license, or stopped operating. Both exchanges continued to function afterward. What the incident does establish is a documented data point worth factoring into how you assess exchange risk, alongside things like withdrawal history, audit frequency, and how transparent the platform is about what happened and what changed.
How Do Supply Chain Attacks on Exchanges Work?
Think of an exchange’s security the way you’d think about a building’s security: the front door can be locked tight, but if a contractor who installed the wiring left a backdoor, the lock on the front door doesn’t matter. In crypto terms, that “contractor” is often a third-party library, a hardware wallet integration, a cloud infrastructure provider, or a vendor that handles part of the signing or key-management process.
Attackers who compromise that vendor don’t need to break the exchange’s own code at all. They ride in through a channel the exchange already trusts. That’s part of why these attacks are harder to catch in real time, and why they tend to produce larger losses when they succeed: the compromise can sit in a trusted system for a while before anyone notices unusual withdrawal patterns. If you want a longer view of how different attack types stack up historically, our ranked rundown of the biggest crypto exchange hacks is a useful companion read, since supply chain incidents sit alongside hot wallet breaches, bridge exploits, and insider risk as recurring categories.
Is Bitget Safe to Use After Past Security Incidents?
“Safe” is the wrong frame for any exchange, honestly. The better question is what controls exist now, and whether the exchange has been transparent about what it’s changed. Bitget publishes security and reserve information on its official site, and like most large exchanges it has continued operating and adding products since 2024. That continuity tells you the business survived the incident; it doesn’t by itself tell you the underlying infrastructure risk has been eliminated, because no exchange can credibly claim zero risk from third-party dependencies.
Our general view on this site: past incidents matter less as a permanent mark against a brand and more as a prompt to check current practices. If an exchange has published incident post-mortems, increased audit frequency, or added proof-of-reserves reporting since a known event, that’s a more useful signal than the headline from the original incident itself.
What Traders Should Actually Check Before Depositing
A few things are worth checking on any exchange, not just one with a documented past incident. We cover this in more depth in our guide on how to check exchange security before depositing, but the short version covers reserve transparency, incident history, withdrawal reliability, and how custody is actually structured.
| What to check | Why it matters | Where to look |
|---|---|---|
| Proof of reserves | Confirms reported assets roughly match liabilities | Exchange’s own disclosures or third-party attestation |
| Incident disclosure history | Shows whether past hacks were explained publicly, not buried | Exchange blog, security page, reputable news coverage |
| Hot vs. cold wallet split | Smaller hot wallet exposure limits damage from any single breach | Security pages, audit reports where published |
| Withdrawal reliability | Delays or freezes often precede bigger problems | User reports, your own small test withdrawal |
| Regulatory footprint | Affects recourse if something goes wrong | Terms of service, regional restriction pages |
None of these checks guarantee an exchange is risk-free. They just move you from guessing to having a basis for comparison. If you’re weighing Bitget against alternatives on these criteria, our exchange rankings and individual exchange reviews lay out the same categories side by side.
The Bigger Picture for Exchange Security in 2026
Supply chain risk hasn’t gone away since Q3 2024; if anything, the growing number of integrations, third-party wallet SDKs, and cloud dependencies that modern exchanges rely on gives attackers more entry points, not fewer. That’s a structural problem for the industry, not a flaw unique to any one platform named in a given quarter’s loss tally.
For traders, the practical takeaway is less about avoiding any specific exchange and more about building a habit: check reserve disclosures periodically, not just once; keep an eye on how quickly an exchange communicates when something does go wrong; and size deposits with the understanding that even well-run platforms carry some custodial risk you don’t fully control. That’s true whether you’re using Bitget, a competitor, or any centralized platform holding your funds on your behalf.
Frequently asked questions
Is Bitget safe to use after past exchange security incidents?
Bitget has continued normal operations and remains one of the larger derivatives exchanges by advertised volume as of 2026. Safety is not binary; it depends on what security measures are in place today, not on any single past incident. Check the exchange's current security disclosures, proof of reserves, and incident history before deciding how much to deposit.
How do supply chain attacks on crypto exchanges work?
Instead of attacking an exchange's own code directly, attackers compromise a third-party vendor, software library, or signing tool that the exchange relies on. Once that dependency is poisoned, the attacker can reach wallets, transaction signing, or internal systems through a trusted channel. These attacks are harder to detect because the entry point looks legitimate.
What fees does Bitget charge for futures and spot trading?
Bitget publishes tiered maker and taker fees for spot and futures on its official site, and actual rates depend on account tier, VIP level, and trading pair. Rather than quoting numbers that change over time, confirm current fees directly on Bitget's fee schedule before trading.
How does Bitget KYC compare to other exchanges for non-US traders?
Bitget requires identity verification for full account features, similar to most major exchanges, with verification tiers that unlock higher withdrawal limits. Requirements and supported document types vary by country, so non-US traders should check the current regional rules on Bitget's own verification page rather than assume uniform policy.
Are hacked exchange funds ever recovered and reimbursed to users?
Sometimes. Exchanges with insurance or reserve funds, white-hat negotiations with attackers, and law-enforcement asset freezes have all led to partial recovery in various industry incidents over the years. There is no universal guarantee, though, and recovery timelines and amounts differ case by case.
Does Bitget operate legally in restricted regions in 2026?
Bitget, like most offshore exchanges, restricts or limits access in certain jurisdictions, including the United States, and rules shift as regulations evolve. Traders should check Bitget's current terms of service and their own local regulations rather than rely on older guidance.
What was the Liquid exchange hack and has it been resolved?
Liquid was named alongside Bitget in Cointelegraph's reporting on Q3 2024 exchange exploits, which attributed a large share of that quarter's roughly $1.2 billion in losses to supply chain and infrastructure vulnerabilities. Specific resolution details for individual cases were not part of the available reporting, so traders should look for the exchange's own public statements for updates.
How can I verify an exchange's proof of reserves before depositing?
Look for a published proof-of-reserves page, third-party attestation, or on-chain wallet addresses the exchange discloses publicly. Cross-check that the reported reserves actually cover customer liabilities, not just a snapshot of assets, and treat self-reported figures with the same skepticism you'd apply to any unaudited claim.