EXCLUSIVE INTERVIEW WITH BITGET CEO GRACY CHEN | BITGET CEO ON Bitget Withdrawal

Um, so okay, so thank you for, uh, having me. Uh, I apologize that it seems that I'm also, uh, quite, quite zone out a little bit because I was also dealing with some internal discussion from my team, like some urgent things that we need to talk about. I apologize on that. So, um, for your questions specifically on 25th local time, my local time GMT plus 8, and that is, uh, um, GMT or UTC time zone 6:31, that's when we saw the first, uh, unauthorized transaction from the hackers. But the very, uh, first few transactions are actually in a small amount of money. So, um, that is exactly some, uh, 0.884 of Ethereum from Ethereum hot wallet and 93 TRX from a TRX hot wallet. So both were below the risk control threshold and did not trigger a system alert. So, uh, our team nor system did, uh, reacted to that at all. But basically local, uh, sorry, UTC time 6:58 PM that day, um, the attacker initiated, uh, a few large transfers across Ethereum, XRP, ZEC, BSC, Base, ARB, Optimism, and Avalanche. Um, and hence that's the start of the, um, the total, sorry, the total hack, uh, and the exploit. So in total, uh, we estimate the loss to be, uh, 388 million USDT equivalent of assets, uh, based on the price of, uh, those assets on the day. And, uh, our investigation found that the attacker exploited a vulnerability in a third-party security product to obtain high-level internal credentials. The attacker then used these credentials to send fraudulent withdrawal commands to the wallet system, causing it to execute abnormal transfers that bypassed risk control. Uh, private keys were not compromised, cold wallets were not affected. Um, that's the primary investigation that we have and we're going to publish a more detailed incident report very soon, likely today or tomorrow.

Okay. So, for the users, uh, this incident doesn't affect any users, uh, fund or account. Basically, the users' balances are still the same. Uh, the financial impact of this incident will be totally covered by Bitget, by our user protection fund which we established, uh, in 2022. So users don't need to do anything, they don't need to change passwords, they don't need to reset API keys, etc. Uh, and Bitget will be bearing all the cost and, uh, loss.

Yeah, it's definitely not private key, uh, sort of compromise nor is it related to cold wallet. Uh, the incident only happened to our hot and warm wallet infrastructure. Again, the hack started off because the hackers exploited a vulnerability in a third-party security product that they obtained high-level internal credentials to Bitget and then initiated unauthorized transfers.

Sure. Yeah, I can do some, uh, introduction around that. So basically for wallets, a lot of exchanges use this sort of infrastructure. Uh, most if it's just retail user or some institutional cases, maybe it's mainly hot wallet and cold wallet. The hot wallet is continuously online, is directly connected to the internet. They are used to process some routine user, uh, sort of trading activity or for us in our case, it's basically to process users' withdrawal requests. So this is a fast access to funds but also because it's always connected on the internet, it also has a greatest exposure to any sort of online security risks. So, uh, this also in the, uh, exchange infrastructure, it also holds only a very small portion of the platform's total assets. That's a hot wallet. And then cold wallet on the very end layer, it is completely offline. It is physically isolated from the internet. Uh, if you want to access the cold wallet, you have to require, uh, sort of manual intervention, multiple signatures, strict operational procedures, etc. And hence it's much secured but also the access is slower. It's just the two sides of the coin that you can't have both, right? And then for exchanges like us, we also had another layer in between hot wallet and cold wallet which we call warm wallets. So warm wallets serve as an intermediate layer between hot and cold and warm wallets, they are not continuously online like hot wallets but neither are they completely isolated like cold wallets. So warm wallets is used to replenish the hot wallet liquidity when needed. It's also accessed relatively quickly but require additional authorization steps. So this is how this infrastructure look like. It is the case in our, uh, infrastructure when it goes to wallet. It is also a common practice in top exchanges.

Yes. So, first of all, let me explain why it need to be restarted in phases. Uh, as we explained earlier, this incident itself affected the end-to-end withdrawal infrastructure across multiple blockchain, multiple assets and multiple layers of, uh, our wallet infrastructure. So we needed to ensure that when we started or starting the withdrawal, all the blockchain that has to, that is, you know, related to the withdrawals had to undergo several core verification procedures before opening up. So the withdrawal suspension is more of a security measure, uh, and hence you see we started off with BTC because BTC is not an asset affected in this incident and the BTC withdrawal yesterday was very smooth. It started on UTC 28th 8 a.m. And, uh, within about, um, an hour or so, there were more than 4,000 bitcoins withdrawn from Bitget and they are all processed very smoothly. And today just, uh, 45 minutes ago, that depends on when this podcast is going to be published, but basically when we are recording this is, um, UTC time 8:44. So just 44 minutes ago we started the withdrawal of Ethereum and according to my team, that withdrawal also went very smoothly. And tomorrow same time UTC 8:00 a.m. 30th of September, we're going to start the USDT withdrawal. And then on the 2nd October, same time, it's all the other altcoins and assets and fiat and P2P, uh, all the business should be back to usual by Friday UTC time. Um, so that's basically the process. And again, uh, in terms of the phases and why it's this order, well we talked about BTC, uh, is the first one, uh, the second one of Ethereum and USDT is largely due to the fact that, um, these two assets are also, uh, needed or it's a major asset class on Bitget in terms of users' portfolio. So we prioritize these two assets than any other altcoins so that our users can get their money if they want to withdraw as soon as possible.

Yeah. So if we can look at FTX case, it's obviously very different, right? FTX, uh, fundamentally is different from Bitget and us because FTX, uh, the root cause of FTX bankruptcy was a fraud. It's not a hack. SBF, the founder of FTX, he diverted customer funds to Alameda Research for investment and hedging activities. So they don't have enough money to pay back their user when their users needed to withdraw. So once FTX stopped withdrawal, it effectively confirmed the market's fear that the customer funds were no longer there and, uh, and then the situation also spiraled, went sort of like we call it spiral death and there was no way for FTX to demonstrate solvency because the funds that they co-mingled to, uh, Alameda and then Alameda lost many of them. So that's the FTX case. But Bitget, if you look at that example, just, um, just like Bitget and us, like we are in the sort of the same boat that we are victims of an external hack. This is not an internal fraud and, uh, a lot of, uh, aspects are also very important. Like I think both Bitget and us demonstrated key, um, sort of transparency and communication with the audience, with the users, with just the crypto community in general. Um, the reserves are also very real. Like Bitget's case, it, uh, replenished liquidity through their emergency industry loans including some loans that we actually lent to them. Uh, there were 40,000 Ethereum that we gave Bitget, uh, on the day of the incident, uh, with no interest, no collateral, no payback date because we know that they can survive the crisis and they can pay us back, which they did very soon. Uh, in our case, we don't even need those emergency loan. We can, our own protection fund can totally cover the loss of this hack. So the case again fundamentally is very different from FTX.