Bitget Hack Raises a Bigger Question: Are Crypto Exchanges Safe?

The reported $351.6 million Bitget security breach has brought back an important question in crypto: Should investors keep their assets on centralized exchanges, or use decentralized exchanges (DEXs) and cold wallets instead?

On September 24, Bitget saw unauthorized transfers from some of its hot wallets, losing $351.6 million. The exchange said its cold wallets were not affected and that its User Protection Fund held more than $464 million to cover the loss.

Bitget later said it had identified the attack method, fixed the vulnerability, and was working with security firms Mandiant and SlowMist to investigate.

Notably, the attack has been linked to North Korean groups. Elliptic said the Bitget attack pushed the total North Korea-linked crypto theft to above $1 billion in 2026.

But the biggest issue for investors is: 

Who controls your crypto’s private keys?

Problem With Keeping Crypto on Exchanges

Centralized exchanges make crypto trading easy. You buy and sell Bitcoin, Ethereum, XRP and other assets without managing blockchain keys yourself. The trade-off is that the exchange controls the private keys for assets held in its wallets.

This creates a major security risk, as one successful attack affects many customers at once. The Bitget incident shows this clearly. Bitget said the attack affected its hot and warm wallet systems, while its cold wallets remained secure.

That does not mean every centralized exchange is unsafe. Exchanges use cold storage, security monitoring, withdrawal controls, protection funds and other safeguards.

However, when you keep crypto on an exchange, you trust a third party to protect it.

Are Cold Wallets Safer?

For people who plan to hold Bitcoin for a long time, cold storage reduces online security risks. A cold wallet keeps private keys offline, making them less exposed to internet-based attacks. Hardware wallets are one common form of cold storage.

Moving Bitcoin from an exchange to a properly secured cold wallet also removes the exchange from custody of those coins.

But there is a trade-off:

With self-custody, you become responsible for your own security. If you lose your recovery phrase, you permanently lose access to your crypto. Unlike an exchange, there is no customer-service team to restore your account.

A hardware wallet can also be lost or damaged. If someone gets your recovery phrase, they can take your crypto. For this reason, self-custody requires protecting both the wallet and its backup.

What About Decentralized Exchanges?

Decentralized exchanges, or DEXs, provide another option. A DEX allows you to connect your own wallet and trade through smart contracts instead of depositing your assets into an exchange-controlled wallet.

This removes one major risk: your funds are not sitting in a centralized exchange’s wallet.

But DEXs have their own risks.

Smart-contract bugs cause losses. Hackers exploit poorly designed or compromised protocols. Users also face fake tokens, price manipulation and liquidity problems.

There is also a risk of phishing and malicious transactions.

For example, a fake website can trick you into approving a transaction that gives a malicious contract permission to spend your tokens. Once a transaction is confirmed on the blockchain, you can’t reverse it. 

So, a DEX reduces centralized custody risk, but it does not eliminate crypto risk.

CEX vs. DEX: The Risk Changes

With a centralized exchange (CEX):

• You trust the exchange to protect your assets.
• The exchange controls the private keys.
• You benefit from convenience and liquidity.
• You face risks such as hacks, operational failures and withdrawal freezes.

With a DEX and self-custody wallet:

• You control your private keys.
• You interact directly with blockchain applications.
• You avoid giving an exchange custody of your funds.
• You take responsibility for wallet security, transactions and recovery phrases.
• You face risks such as smart-contract bugs, phishing and malicious approvals.

Neither option is completely risk-free. But which risks do you understand and can manage?

Should Long-Term Bitcoin Holders Use Cold Storage?

For someone holding Bitcoin for years rather than actively trading, keeping long-term savings in cold storage reduces dependence on centralized exchanges. This does not mean investors have to stop using exchanges.

For example, someone can:

• Keep a smaller amount on an exchange for trading.
• Keep long-term Bitcoin holdings in cold storage.
• Move only the amount needed for trading onto the exchange.

This limits the amount of money exposed if an exchange account or wallet system is compromised.

What Is the Safest Way to Store Crypto?

There is no completely risk-free way to store cryptocurrency. For long-term Bitcoin holdings, a properly configured hardware or offline wallet reduces exposure to online attacks.

For active trading, centralized exchanges remain useful because they offer liquidity and convenience. Strong passwords, hardware-based authentication and withdrawal protections help reduce account risks.

For DeFi users, it is important to:

• Check that you are using the correct website.
• Check what a transaction is asking you to approve.
• Avoid signing unfamiliar transactions.
• Be careful with links and messages that are phishing attempts.
• Keep only the amount you need in your connected wallet.

Lesson From the Bitget Hack

The Bitget incident doesn’t mean investors should abandon centralized exchanges or move everything to DEXs. Instead, it highlights a basic crypto rule: how you store your crypto is itself a security decision. 

Keeping assets on an exchange means trusting that company to protect them. Using a DEX removes the exchange from the custody process but introduces smart-contract, wallet and phishing risks. Using cold storage reduces online exposure but means you are responsible for your private keys and backups.

Related: SEC Crypto Custody Rule: What Could Change for Investors, Crypto Funds, and Digital Asset Accounts?