Bitget adds Kazakhstan, Russia, and Belarus to its restricted countries list

Bitget’s updated terms of use, revised on 16 October, now place Kazakhstan, Russia, and Belarus on the exchange’s list of restricted jurisdictions. For high-risk operators and PSPs, the important bit is that the restriction applies not just to nationality, but also to residence and to companies registered or doing business in those countries.

1. In the updated terms, Bitget says users are restricted if they live in any listed country, or if they are organizations registered there or conducting business there. In other words, this is a residency and business-presence rule, not just a passport check.
2. Bitget also says it may block or cancel transactions, suspend access to services and accounts, and restrict withdrawals of digital assets. The terms further state that access can be closed if a user is in a prohibited country, and that bypassing these restrictions via VPN is forbidden.
3. The restricted list is not a small one. It includes the US, Canada, France, Germany, Austria, Japan, Iran, North Korea, Cuba, Iraq, Libya, Hong Kong, Singapore, Malaysia, and Thailand. It also names Crimea, Donetsk, and Luhansk, plus Afghanistan, Sudan, Somalia, and South Sudan. Bitget says it reserves the right to add other countries and territories.
4. For companies tied to the US, Bitget says it may request additional information to determine whether an entity falls under American restrictions. That matters for PSPs and counterparties that run multi-entity structures or touch US persons somewhere in the chain.
5. According to Incrypted, the terms update followed a security incident on 24 September. Bitget first said there were unauthorized withdrawals from part of its hot and warm wallets and initially estimated the loss at 351.6 million dollars. In a later statement on 30 September, it put the total damage at about 388 million dollars. Bitget said private keys were not compromised and cold wallets were not affected.

Gracie Chen and on-chain analysts suggested the attack could have been linked to North Korean hackers, but that connection was not confirmed. For the payments side of the industry, the practical takeaway is simple: exchange terms can tighten fast after an incident, and the country list is only half the story—the operational definition of “restricted user” is often broader than people expect.