An extortion group says it walked off with a mountain of data from TiDB Cloud, a managed database service used by companies around the world. Bitget, one of the firms named on the group’s list of affected clients, says its users have nothing to worry about.
On October 20, 2026, Xie Jiayin, Bitget’s head of Greater China operations, confirmed that the exchange had used TiDB Cloud. According to Xie, it held only non-sensitive public trade logs, and Bitget had already stopped using the service more than two months earlier.
What FulcrumSec is claiming
The allegations come from FulcrumSec, a group that operates on the extortion model. The pitch to victims is simple: pay up, or watch your data get published.
FulcrumSec claims it stole approximately 10.6 TB of data from TiDB Cloud, spread across 4.9 million files. The group says the haul includes customer records and API keys.
The group also claims the breach could affect more than 180,000 organizations. That would make it a sprawling incident, if the numbers hold up.
As of October 20, the claims had not been independently verified. FulcrumSec published a data sample of roughly 200 GB shortly after announcing the breach, but outside confirmation was still pending.
Bitget’s version of events
Bitget’s response rests on two points: what it stored, and when it left.
On the first, Xie said the exchange kept only public trade logs in TiDB Cloud. Public trade data is, as the name suggests, already public. It is the sort of record anyone can see on an exchange’s order book, which makes it a poor prize for a thief.
On the second, Bitget said it had ceased using the service more than two months before FulcrumSec went public. The exchange said an internal review found no exposure of user data or sensitive information such as passwords.
Bitget also framed the episode as a supply-chain style issue rather than a direct breach of its own systems. The exchange emphasized there have been no confirmed instances of data exfiltration involving customer assets or information. Even so, it advised users to stay alert for phishing attempts in the wake of the incident.
A wider list of names
Bitget is not alone on FulcrumSec’s roster. The list of allegedly affected TiDB Cloud clients also includes Pionex, another crypto trading platform, and Chinese tech giant Baidu.
TiDB Cloud is a managed database offering from PingCAP. “Managed” means the provider runs the infrastructure so customers do not have to. That convenience is the whole selling point, and it is also the reason one compromised provider can ripple outward to many customers at once.
What this means for exchanges and their users
For Bitget customers, the immediate picture looks fairly calm, based on what the exchange has said. If Bitget’s account holds, the only data in TiDB Cloud was information already visible to the public, and the exchange had moved on from the service before the claims surfaced.
The practical takeaway for users is the one Bitget itself offered: be skeptical of unexpected messages. Any email or text referencing this incident and asking for login details, seed phrases, or account verification deserves a second look.
The biggest open question is whether FulcrumSec’s claims survive independent review. If the 10.6 TB figure and the 180,000-organization estimate are confirmed, the fallout will extend well beyond crypto, and PingCAP will face hard questions about how it happened.
The next developments to watch are any verification of the leaked sample, any statement from PingCAP, and whether other named clients such as Pionex or Baidu offer their own accounts of what, if anything, they stored on the platform.
Disclosure: This article was edited by John Chen. For more information on how we create and review content, see our Editorial Policy.