Head of multimedia here at The Block and the host of The Starting Block, our daily show that we've been broadcasting for the last three months already. It's crazy to think we've already been on air for three months. If you are joining us and you're wondering, things look a little bit different today. We are broadcasting on Riverside. We had some issues with our usual studio, but nevertheless, it doesn't change the programming. It doesn't change the big conversation that we're going to be having today. Big news late last week. Bitget suffered a major hack and CEO Gracy Chen has been graceful enough to join us for a chat this afternoon to unpack everything that's happened since then and what happened with the incident itself. So, first things first, Gracy, welcome back to the show. You were with us a couple of months ago. This time, a little bit more stress involved. First things first, hello. How are you doing?
Good. Thank you. The incident happened on Friday. So over the weekend I obviously didn't have much sleep. Other than that, I don't think we have any major issue now especially given a couple of hours ago we started to allow our users to Bitcoin withdrawal. It went very smooth. There were, I think, I don't even have the newest number but around one hour after the withdrawal started there are 7,000 plus orders withdrawn successfully and that involved more than 3,000 bitcoins. Again, that went very smooth, nobody is lagged and I'm glad that I think this is the recovery phase of our crisis.
Yeah, sure. I think it always puts users at ease once an exchange comes back online and begins processing deposits and withdrawals. And I think it's a natural reaction for a lot of people to withdraw funds once something like this has happened. Gracy, I want to take you back to last week. If you can talk to us a little bit about the incident itself, how things played out on the day, what first brought it to your attention that something was going wrong and maybe you can talk a little bit about the incident itself and how the attackers managed to gain access to your systems and withdraw these funds.
Okay, sure. Yeah. So for those who just joined this session without knowing anything about the Bitget incident, let me do a full recap. Beginning at 6:31 p.m. UTC on September 24, 2026, there were some unauthorized transfers that involve certain assets that were made across multiple blockchains from Bitget hot and warm wallet infrastructure. So far our investigation has found the result already. We are going to publish a formal incident report shortly and basically the investigation has found that the attacker exploited a vulnerability in a third-party security product to obtain high-level internal credentials. Then the attacker used these credentials to send fraudulent withdrawal commands to the wallet system causing it to execute abnormal transfers that bypassed our risk control system. Well along the way private keys were not compromised, cold wallets were not affected. And where we are now. So we have already confirmed that approximately 388 million USDT equivalent of cryptocurrencies in assets were transferred out and now we have Mandiant and SlowMist as two separating independent organizations supporting us to do investigation and the on-chain tracing efforts. We're going to publish the report really soon but even on the first day of the incident we've already published the identified attacker addresses and some relevant tracing data to support the broader industry collaboration. We've launched some bounty program and that's the hackers tracing part. In terms of our users, all the users are not affected in terms of their user balance. The losses from this incident will be fully covered by our own Bitget user protection fund which we established in 2022. So we will use our own capital from the protection fund to cover the loss and we will then use our other capital to replenish the fund back to at least 300 million in a week. I'll stop here and maybe take more questions but of course about the details of the incident there are more things that we can discuss.
Yeah sure. I think the first thing for me is how quickly your team was able to figure out what had actually happened. I think most, you know, victims of these kind of attacks, that's the hard part. And it seems like internally Bitget was able to pin down, you know, how this actually happened. Was that thanks to this third party that was involved? How did you kind of figure out that this is actually what happened and how the attackers gained access? And do you think that this is also the result of having access to frontier LLMs, AI models to help you know find vulnerabilities in service providers, exchanges, the kind of hacks that we've been seeing in recent months.
Yeah. So about AI that we can talk about more but let me before we dive into this question, let me give you more details on the timing so that we get to see what exactly happened. We mentioned 6:30 p.m., 6:31 p.m. specifically on UTC time that day. That was when the first unauthorized withdrawal occurred. But that amount is actually very small. So, there were two transactions, one Ethereum, one TRX Tron. So, there were 0.84 Ethereum from an Ethereum hot wallet and then 93 TRX from a Tron hot wallet that's transferred out. So both of these two transactions were way below the risk control threshold and they did not trigger any system alert. But then about half hour later, which is at 6:58 p.m. that day, the attacker started to initiate large transfers. And they've initiated 17 large transfers across Ethereum, XRP, ZEC, BSC, Base, ARB, Optimism, and Avalanche since 6:58 to 8:09 p.m. that day. UTC again. And that's a total value of approximately 361 million USDT equivalent of cryptocurrencies. So that's the major losses that we were bleeding. But the system actually reacted pretty quick. So within 7 minutes of their first large transfer at 7:05 p.m. that day, our reconciliation system detected a significant discrepancy and the risk system automatically blocked user-initiated withdrawals platform-wise. But this didn't really stop the hacker's behavior. We can explain slightly further on why actually down to the ground the hacker pretty much just pretended a credential or sorry the... so they okay I'll just go to that session first. So there were three steps that the attacker did. Step one is that they obtained internal credentials and accessed our internal system. How did they achieve that? They achieved that by using or exploring a third-party product's zero-day vulnerability that we are working with. So it's not our vulnerability, it's a third-party product's vulnerability. But that vulnerability allowed the attackers to gain access to this critical internal management system that we have. And hence hackers pretended to be a real person, a real management credential and this impersonated identity information because it's a real one and it's a valid one. The system just treated this access as a normal login from the credential. So that's the first step. Then the second step is they the attackers used they created some fraudulent withdrawal commands and caused the wallet system to execute these transfers. So they use this compromised administrative privilege that they accessed the wallet related backend servers and directly inserted the fraudulent withdrawal commands into the wallet system. The wallet system treated these commands as legitimate withdrawal. So they allow the attackers to bypass the withdrawal risk control and that would normally apply before a withdrawal record is generated and the transfer assets from the hot and warm wallets. That's the second step. Then the third step is also in my opinion the trickiest part is that they've been also erasing the traces. So after completing the transfer, the attacker deleted all the traces that the fraudulent withdrawal commands might have left behind in an attempt to conceal the attack and hinder the root cause identification. So due to the lack of these direct evidence, we needed to examine a broader range of systems to identify the root cause and that's why it took longer and more sort of coverage on different chains on different system etc. so that we can remediate and fix the problem. So now after remediation the subsequent verification process... sorry basically following remediation the... sorry I've been talking a lot but basically that's like the third part of erasing traces.
Yeah. I'll give you a moment there just to maybe have a sip of water and catch your breath while I tee up the next question. I think the next question that comes to my mind and something you've already touched on a little bit on social media was links to previous hacks and you know potentially identifying that this hack was carried out by North Korean linked hackers. Can you tell us a little bit more about what you know so far before we pull on that thread a little bit? Tracing the funds where the attackers have been mixing some of these funds or carrying out token swaps.
Yeah. So my stand still stands whichever we mentioned earlier on the 25th but because we are also going to publish an incident report together with Mandiant which is a Google Cloud company and then SlowMist both of them are written independently to recover the facts and so that we can tell everyone and we have more confidence to be sure that this is exactly the fact of the incident itself. So that incident report will discover and well discuss the hacker's identity, the exact or at least give you more technical and context about what we explained earlier on how this incident happened. So before this report is finalized and published, I wouldn't want to speculate on the exact hacker. But personally, the decision or the so-called earlier speculation didn't really change. So it's still the same group of people that we suspect. But let's wait for the formal incident report. I think that's an easier way to you know prove and publish information.
Yeah, sure. I mean we can follow breadcrumbs and make some assumptions but it's only final when we know that we can point a finger in that direction but on-chain data, this is the beauty of on-chain data is it allows you to make some educated guesses ahead of time. And it's very interesting to see that that's what that's pointing towards. Just pulling on that vein, I'm not sure how much you want to talk about this, but I know you had said online that you'd asked Thorchain to step in and block some on-chain swaps that were going on. They've turned around and said that look, we're a permissionless network. We can't quite do that. This is also just the nature of crypto, right? Getting people to stop token swaps happening on permission networks is very difficult to do. If they went through a mixer or something like that, it would be a similar situation. But it does allow us to trace on-chain funds and see where things are going. Just your general thoughts on what's happened there.
Yeah, so for Thorchain, as people might know, I sent them a public so-called message asking that Thorchain not to serve the fraudulent hackers or any addresses that's obviously attacked already by us that they come from the loss and the stolen funds from us. So like what you mentioned earlier, Thorchain also replied publicly that they claim that they are just like Ethereum and Bitcoin and they wouldn't be able to do anything about it. Basically use decentralization as excuse to just as a reply. I'm a little bit frustrated about that reply but over the weekend was very busy with a lot of things. So didn't really have time to reply nor continue any sort of like a fight. This is not a fight that I want to get into. I also respect decentralization a lot. I appreciate Bitcoin's design of decentralization and you know node operation contributions etc like how nodes and miners etc all work very differently in order for that blockchain to work similarly for Thorchain so for today I try to approach Thorchain privately as well through some third-party organizations that might know them so far there isn't any direct response from their team. But I want to just call out and say because this is like a repeated pattern that we see that hackers use Thorchain to launder the stolen assets from Bitget's case, from Curve, from us like all these just hit the same pattern. So while respecting the permissionless design fully, we also want to you know talk to them and discuss from the people the developers who are actually running it to understand what's technically and governance-wise possible so that we can find something workable together. Yeah. So this is the key message that I want to send to them. If there's anyone who are hopefully listening to this podcast that might be helpful, please reach out to me directly. My DM is open on Twitter on x.com. We want to work together with not just Thorchain but any other decentralized or centralized infrastructure to stop hackers from laundering those stolen assets.
