In three weeks Bitget gave two reasons to think about where your money sits: in September $351.6 million was taken off it, in October it closed access for clients in Russia, Belarus and Kazakhstan. We go through both events from primary sources, work out what holding your own keys actually changes — and, more importantly, what it does not.
18 October 2026 · verified at publication
They are not connected — at least the exchange explains no connection, and no source shows one. But they happened back to back and strike the same point: money on an exchange is not technically yours.
The exchange spotted the unauthorised transfers at 18:31 UTC. Funds left hot and warm wallets across seven networks — Ethereum, XRP Ledger, Arbitrum, Avalanche, Optimism, BNB Chain and Base, the largest share in XRP at about 158 million. The estimate was later raised to roughly 387.5 million as further transfers were found. At the time, the largest confirmed theft of the year.
The Terms of Use were updated: Russia and Belarus were added to the list of prohibited jurisdictions, Kazakhstan had been there before. From 18 October new trades, orders and subscriptions are unavailable; by 21 October positions must be closed and funds withdrawn; from 21 October account login is restricted. Getting round it with a VPN is banned in a separate clause. The exchange cites regulatory compliance as the reason.
A theft from an exchange usually comes with "the keys were stolen". Not here, and the difference matters.
Private keys were not stolen and cold wallets were untouched. The attacker got into the backend and spoofed the transaction data that the authorization system saw. Someone else's withdrawals passed the standard approval procedure as legitimate. In the words of CEO Gracy Chen, the attacker "manipulated the transaction data shown to its authorization process".
What this means for a depositor. You can guard your keys all you like — if somebody else's approval system stands between you and the money, that is what is vulnerable. The intruder needs neither your password nor your two-factor check: he deceives not you but the mechanism that decides whether a withdrawal is legitimate. There is no way to defend against this from the user's side.
The attribution the exchange gave is preliminary — North Korean groups, based on VPN addresses, overlaps with wallets from earlier hacks and the laundering pattern. Analysts at TRM Labs state plainly that they have made no definitive attribution.
The three countries in the headlines are not the whole list. The updated terms name twenty-eight prohibited jurisdictions, and the composition explains the logic.
Besides sanctioned states and conflict zones it includes Japan, Singapore, Canada, France, Germany, Austria, Hong Kong, Malaysia and the United States. So this is just as much about heavily regulated markets the exchange will not enter without a licence. The decision is taken not against a country but in favour of its own regulatory convenience — and anyone can end up on the wrong side of it.
Five days for everything. From the amendment on 16 October to the login cut-off on the 21st. If during those days you are on holiday, in hospital, or simply not reading email from the exchange, there is nobody to close your positions. That is precisely the risk absent from self-custody: there, nobody sets you a deadline.
Rainbow is a non-custodial wallet: the private key is kept on the user's device and the company has no access to it. Several things follow that do not depend on the company's goodwill.
The Bitget scenario does not reproduce here. There is no third-party authorization system to fool with spoofed data: the transaction is signed by the key on your device. Breaking into the company's infrastructure gives no access to users' funds, because the company holds none.
A line in the terms of use does not revoke a private key. Even if the company shut down tomorrow, the funds would remain reachable: the secret phrase works in any compatible wallet, and the address and its history live in the blockchain, not on a server.
Nobody gives you five days to withdraw. That sounds like a small thing right up to the day somebody does.
This section matters more than the previous one. Self-custody shifts the risk rather than removing it — from the counterparty to you — and an honest piece has to say what that costs.
The loss was covered by the User Protection Fund, which holds more than 464 million dollars. In this particular hack the depositor lost nerves and time, but not money. Somebody who signed a malicious transaction or lost their secret phrase has no fund. And no support. And no undo.
A lost phrase means the funds are gone for good — nobody can restore it, and that is the whole point of the design. A transfer to a wrong address does not roll back. A signature on a malicious approval hands over tokens with no hack at all, and formally it is your own voluntary transaction.
The key cannot be taken away, but features are not available everywhere. In Rainbow itself the Cash section works only for customers in the United States, excluding New York and California, and only with a Visa card. Claiming that wallets know no geographic limits would be untrue: the key really cannot be seized, but the product around it answers to the same regulators.
How to compare this honestly. An exchange carries counterparty risk: its systems being broken, a block by jurisdiction, a deadline set for you — but insurance funds exist, and in Bitget's case the fund worked. A wallet carries user risk: it is entirely yours, irreversible and covered by nothing. This is not "one is better than the other", it is a choice of which risk you are willing to carry.
Centralised exchanges have loyalty tokens — BNB, OKB, BGB, GT. Rainbow has RNBW. The comparison suggests itself, so let us say at once where it works and where it does not.
What is verifiable. Rainbow buys RNBW back off the market. It is done by the treasury address — a Safe multisig where a transfer needs two signatures out of three:
0xcaa9bFCbc9ff87428535bc4E163296c3A8ae308E
Between February and October 2026 it bought … RNBW with market orders through Uniswap and Aerodrome pools, paying in USDC. The address makes no sales back. The app's revenue per DeFiLlama is … a year.
Recounted daily from the token's transfer log; only a transfer with USDC paid out in the same transaction counts as a purchase. The detailed breakdown is in the piece on Arthur Hayes's criteria.
And here is what is absent, worth knowing before buying. No obligation to buy back is fixed on chain. There is no contract routing a share of fees into purchases of the token, and no document requiring it. The buyback remains a company decision it is free to stop. The claim one sometimes meets — "the company buys the token back out of a share of its fees" — describes a mechanism that does not exist on chain: the purchases are real and visible, their link to a share of revenue is not.
It is worth saying separately that on this particular point the comparison with exchange tokens works against RNBW. BNB historically had burning tied to exchange revenue — a harder link to money than a voluntary buyback. A wallet token's advantage is not in reward mechanics but in the fact that the wallet itself cannot be broken the way Bitget was.
An exchange is where a trade is made, not where savings live. A sensible amount to keep on an exchange is one you are prepared to lose to a block or a hack; the rest belongs in a wallet whose key is yours.
The commonest loss of funds in self-custody is not a hack but a lost phrase. It should be written down off the device and off the cloud, and this needs checking before it is needed, not after.
Non-custody is no defence against a voluntary signature. An unlimited approval to spend a token, granted to an unknown contract, hands the funds over with no hack at all — and it will be your own lawful transaction.
We are an independent portal and not affiliated with the Rainbow team. This is not investment advice: every number above is a measurement, not a forecast. The hack and block details follow reports by TRM Labs, CoinDesk, The Hacker News, BleepingComputer and Meduza; the buyback figures are counted by us from the chain and update daily.