CEOInterviews.AI
Start App
Gracy Chen
Chief Executive Officer, Bitget

Inside Bitget's $388M Hack: How the Attackers Got In

📅 Sep 29, 2026 Unchained 79 MIN 1244 VIEWS 91 SEGMENTS · 3 SPEAKERS
Bitget CEO Gracy Chen walks through the September 24 hack that drained about $388 million from the exchange's hot and warm wallets, and how a vendor zero-day let attackers push fraudulent withdrawals past its risk controls without ever touching the keys. Laura presses her on the DPRK attribution, the fight with THORChain over laundering the funds, and whether a protection fund is a real answer to an exchange getting hacked. _______________________________________________________ #bitcoin #ethereum #crypto #cryptocurrencies ++++++++++++++++++++++++++++++++++++++++++++++++ Subscribe to our cha...

What Gracy Chen said

Written from the verified transcript and checked against it. Every figure links to the moment it was said.

Gracy Chen, CEO of Bitget, detailed the September 24, 2026 hack that stole $388 million, describing how attackers used a third-party zero-day vulnerability to access internal systems and execute fraudulent withdrawals. She explained the timeline, including test transfers and a second attack round of about $30 million, and noted the difficulty in identifying the root cause. Chen discussed recovery efforts, including a 5% bounty, and highlighted help from Tether, Circle, and Near Intent, while criticizing Thorchain for refusing to block stolen funds. She addressed allegations from Zach XBT, denied that pump-and-dump schemes originated solely on Bitget, and defended her role as CEO against claims she is a front. Chen confirmed the IPO plan remains on track and reported fewer-than-expected withdrawals, with net inflows after reopening Ethereum withdrawals.

Key takeaways

  1. Bitget lost $388 million in a hack exploiting a third-party zero-day vulnerability, with attackers using fraudulent withdrawal commands.
  2. Only $632,000 of the stolen funds have been frozen so far, with help from Tether, Circle, and Near Intent.
  3. Bitget's protection fund is valued at about $556 million, and the company plans to replenish it to over $300 million within a week.
  4. The IPO plan remains on the roadmap despite the hack, with no major financial plan changes.
  5. Ethereum withdrawals saw a net inflow of 651 ETH within the first hour of reopening.

Numbers and commitments

FigureWhat it refers toTypeAt
$388 million Total amount stolen in the hack metric 14:34
6:31 p.m. UTC on September 24 First unauthorized transfer timestamp timeline 15:00
0.48 Ethereum Test transfer amount from ETH hot wallet metric 15:00
93 TRX Test transfer amount from Tron hot wallet metric 15:00
361 million Volume of first large transfers metric 15:00
30 million Value of second round of attack metric 20:55
632k Frozen amount of stolen funds metric 50:49
5% Bounty for freezing or recovering attacker funds commitment 53:13
556 million Current value of Bitget protection fund metric 55:32
9,674 Ethereum Ethereum inflow to Bitget after withdrawal open metric 1:14:55

Chapters

  1. 0:00Hack timeline and initial detection
  2. 23:19Root cause and third-party vulnerability
  3. 28:56Affected chains and asset recovery
  4. 32:36Freezing efforts and industry cooperation
  5. 36:43Zach XBT allegations and response
  6. 43:22Near Intent and Thorchain contrast
  7. 53:13Bounty and protection fund details
  8. 58:44Security improvements and social engineering
  9. 1:11:58CEO role and public perception
  10. 1:14:55Withdrawal trends and IPO plans

Questions asked in this interview

12
  1. 13:44Not listening to Bits and Bips yet?
  2. 19:48... test transactions and also had covered their tracks because I asked Taylor Monahan what she would ask you and she basically asked why there were these transactions that spanned over what she thought was about three hours. Is that accurate?
  3. 23:11And then what can you tell us more about the third-party system that was hacked and how that transpired?
  4. 25:33Like was it a security company that also understands kind of just that there's a heightened level of security needed for crypto companies or were they more a general provider?
  5. 40:55And do you have a response to his allegations from a few months ago where he felt like these pump and dump schemes were either originating on your exchange, but then also, you know, some of the teams were cashing out from your exchange?
  6. 41:58And from his identification of those aliases in the transactions, did that enable you to either get some of the funds frozen or even recovered?
  7. 49:54And but have you — like when you had the private conversation, did you find that they were amenable to helping you in any way or?
  8. 53:13... you've used to try to get the funds other than these public, you know, requests to get the funds frozen or recovered, and just generally like how did you even come up with the amounts and, you know, how do you kind of approach this effort?
  9. 54:51... create one of these funds, how you amassed the fund, and now that you have actually experienced something where you've had to use it, like is there anything that you would do differently going forward when it comes to a fund like that?
  10. 1:02:31And do you think that was DPRK again or just some like a random?
  11. 1:08:11I do also have to ask, so now that you have experienced this, how does it make you reflect on how your exchange has worked to prevent DPRK from laundering stolen funds in the past?
  12. 1:14:32... incident, I'm curious like now that you have started withdrawals, are you seeing that they're — that, you know, people are withdrawing more than you expected or are you seeing fewer withdrawals than you expected? What's your take there?
Unknown 0:00 ↗
doing it. We're moving at the speed of willpower more and more every day. So I think this AI agents is an extraordinary development. It's why I think semiconductors are a great opportunity. And Meta is first out there. But yeah, Google is coming. Google Spark is in testing right now. It's going to be compelling. Apple sees this. Everyone was going after the personal assistant AI. It was the obvious thing. But there are other AIs coming. The personal concierge, the personal doctor, the personal wealth manager, what we're building at Luma. All of these niches are going to get filled out. So I think it's super exciting if you're long the AI trade and we're going to be mainlining AI now to consumers. Right now it's been mostly an infrastructure and compute story. This data center policy abstract concepts. Now consumers are sourcing tangible value like when they first got their AOL CD and went on the internet. Right? That's what's happening now with these personal assistant agents.
Historically governments have always picked inflation if they can. Right? We've done that in the United States repeatedly. If you look at the history of the 40s and 50s postwar, financial repression. If you were to go and then look at the 70s, financial repression, right? Like every time we get into that position, we end up in that way. And I think with debt to GDP where it is, there's a sort of counterintuitive thing that starts happening, which is if you have $30 trillion of debt outstanding, right? I will remind everybody 1% of the debt is $300 billion. If you raise rates 25 basis points, that's a lot more free cash flow in the hands of Americans given that our debt is relatively short-term and rolling quickly, right? Like there is some bizarro like inversion of thinking that happens when the debt gets big enough where rate cuts are no longer restrictive, but in fact just spray more cash out as well.
They say the rise of agentic AI and machine-to-machine payments will likely increase demand for blockchains and other programmable payment infrastructure, stablecoins, native crypto assets, etc. Existing rails such as card networks, blah blah blah, make them less suited to always-on, very low-value transactions requiring programmatic execution. So what did BlackRock basically say? They said there's going to be a billion agents in 2027. They said the billion agents are going to be doing 217 billion transactions a day and those transactions are going to be settled on blockchain rails because traditional existing rails just aren't relevant for those kind of transactions. And then you say, okay, what's going to capture that value? Layer ones, hedging mechanisms, DEXes, because they're going to be trading in and out of different tokens. And then you start thinking to yourself, hold on a second, maybe this chart is actually conservative. Maybe the altcoins actually outperform Bitcoin by 50x. Why? Because whenever you use a protocol, ask yourself a question. Could an AI and will an AI actually use this protocol? Solana. Yeah, Solana, AI could use Solana. Hyperliquid. Yeah, AI could use Hyperliquid. Near intents, yeah, AI could use near intents. Now, how much more so when the validation is not only likes but actual money and that's what crypto's created. It's created transparent trading machines where everyone can see P&Ls and people are starting to share it. So, if you look at apps like FOMO, pump.fun, we've created a master use case in crypto which is dopamine-driven social trading. And what I think is actually going to happen if you take that and you combine that with a tokenization of everything. All of a sudden, you've got this industry which is a combination of a casino and a social network, but instead of casino, let's call it an investment house. An investment house with a social network. And now that's a monster business that's more powerful than any social network. And in fact, I kind of think that Elon Musk and Twitter have seen this because they're starting to incorporate trading into your Twitter. And people that are testing the Twitter buttons and so the ultimate social network doesn't only reward you with likes, but actually rewards you with increasing net worth. I do say one thing, I'm watching Zcash, and it reminds me so much of Bitcoin back in 2016 and 17. It's the same people. It's the same kind of movement. It's the same price moves. Like I remember when Bitcoin went above $1,000, how quickly it went to $1,500. And that's exactly what happened with Zcash. Like it was at 600 and it's like 700 and then like 800 and then it went through a thousand and then like within 2 weeks it was at $1,500. And it's deja vu because I remember the old Bitcoin days and I'm just waiting for it to go back down to 700 and everyone to get scared and then it'll just go back up to 2,000 because that's what Bitcoin did to us in the old days and it was the same faces. Like I saw the Winklevoss brothers are speaking at Token2049 and they're speaking about Zcash. I was like wow I swear I've got a similar leaflet from 2016 or 2015 or whenever it was of them speaking about Bitcoin at some conference. And so like for me Zcash and the whole privacy around Zcash is super super super interesting. I think it's more useful than Bitcoin. I know you're not supposed to say that because Bitcoin is the king of coins, but there's a better use case for Zcash than there is for Bitcoin. You know, private money is much more valuable than transparent money that everyone can see transaction history, right? So, I know you're not supposed to say that Zcash is maybe a little bit more interesting than Bitcoin, but can't help thinking it.
If you were to set up a system that was designed to generate a lot of volume in the most efficient... the funny part about who are the people who would generate half a billion dollars in volume off 3 million of open interest? People who are hyper-efficient. Who are hyper-efficient? Market makers. That's their job to be as efficient as possible in, you know, what they do, right? So, if you got two market makers and put them in a room and said, "Hey guys, I'll pay you $1 every time you cross each other." Those guys are going to rip your face off. They're going to create so much volume you wouldn't believe it. Now, the question I guess, right, is does that have any benefit to an end user? Because that's the difference between wash trading, right? Even if it's one person, two parties colluding together or whatever and like incentivized liquidity.
It's not an LLM that talks to you like a lot of information goes in and then a classifier makes decisions for you and those decisions come out with weights and the thing is way cheaper and way faster like 200 milliseconds fast. So instead of you let Babel drive your browser and every pass is like I'm going to take a screenshot of this whole thing and I'm going to find the thing I'm going to click and then it gives you like three paragraphs back about what it's finding. This thing is like I'm going to look at everything and I'm going to make a decision based on weights and I'm going to choose the thing within 200 milliseconds. So it's a classifier and it's making decisions very fast and it's very cheap. So, I think that's just like we're going to see on my podcast, we kind of talk about this tension between effective and efficient and you always do it effective first and then you find a way to do it more efficient once you're doing it effectively. I think we're going to see lots of different types of new kinds of models like Jev where it's doing nearly the same task. You know, as long as it's not a chatbot, you're chatting with it. It doesn't do the chatbot thing, but it can do a lot of these tasks and CI type things and browser use type things way faster and way cheaper than just letting Fable click around.
You're using a travel agent. You're not paying for the hotel directly. Like you're not paying the hotel directly. Well, I mean, I guess you could, but yeah, in this case, you're doing a sort of a private concierge, so to speak, because obviously for something to be like a store of value, you need to hold value in it, but then you need to also be able to do things with it to an extent, like things backed by it. I'm upset that like not everybody uses it, but I think a good enough amount of people use it such that it does make a difference is sort of like if you use the Zcash wallet, they all have the pay feature which integrates near intents, which then lets you pay on any chain, right? So you can also I also do Solana USDC with this for example or you can do Ethereum or you can bridge to Robinhood whatever and it's just super convenient and like it's not like a regular bridge where you can just go back and be like oh it came from this other address okay now my private concierge knows how much money I make and therefore now they're going to upsell me on all these sort of different
Importantly I think the biggest unlock has been both Zcash and Mir bringing at last privacy on chain. To me it's always been kind of a biggest bottleneck to use day-to-day blockchain or anything because like I have literally a spreadsheet of 100 addresses on Ethereum and kind of near before we had privacy. So I can track where who where did I send money which address did I use how much gas I left on that address like it's like a nightmare of like accounting system to just keep track of you know to make sure I don't link anything you know go through CEX you know make sure I don't have timing attacks on like amounts etc and all that it gets solved now that we have Zcash and Mir really delivering on kind of like how do you have a private experience using blockchain so I think like all these things really coming together now as more and more people actually starting to use blockchain financial system is moving to blockchain kind of never before. And so at least that's my explanation why things are really really starting to appreciate.
One more thing, we've got a listener survey open. It takes just a few minutes. It's anonymous and it changes what we make next. Use the QR code on screen or go to unchainedcrypto.com/survey. The link is in the show notes.
$540 million. That's how much concentrated liquidity sat idle in a given week in the first half of this year. About 30% of the DeFi TVL if you're wondering. That's according to Dune Research commissioned by 1inch. But there's a solution. 1inch Aqua is the new shared liquidity platform. It lets LPs back multiple positions with the same token balance and keep their tokens in their wallet till a swap comes. Why does that help? Because LPs don't have to split their tokens across positions. They can cover more market conditions and pairs with their full balance. That means more activity across deeper liquidity. See how it works at 1inch.com/aqua. Remember that providing liquidity carries risk and fees aren't guaranteed. Before we dive back in, a quick word about something we make ourselves. If you like the way we cover crypto on this show, clear-eyed, no shilling, just what actually matters, you'll like the Unchained Daily. It's our free newsletter that lands in your inbox every weekday with the most important stories in crypto written by journalists, not marketers. No jargon, no hype, no number go up cheerleading, just the news you need to stay ahead in the time it takes to drink your coffee. Subscribe for free at unchainedcrypto.com/newsletters.
Heads up everyone, we've now fully transitioned Bits and Bips to its new dedicated channels. So, if you're not yet subscribed to the new Bits and Bips channels on X, YouTube, Spotify, Apple Podcast, or wherever you get your podcast, go there and subscribe.
Heat. Heat.
Down.
Everybody.
Jimmy.
Hey.
Feeling feeling it feeling.
Heat. Heat.
Hey, hey, hey.
Heat.
Up.
Here.
Jack.
Laura Shin 13:44 ↗
Hi everyone, welcome to Unchained, your no hype source for all things crypto. I'm your host Laura Shin. Thanks for joining this live stream. First, we'll take a quick word from the sponsors who make the show possible. This episode is brought to you by 1inch Aqua, the shared liquidity layer from 1inch. Back multiple liquidity positions with one wallet balance and keep your tokens in your wallet until a swap fills. See how it works at 1inch.com/aqua. Not listening to Bits and Bips yet? It's our weekly crypto and macro market show with Ram Ahluwalia, Austin Campbell, and Chris Perkins. Search Bits and Bips and subscribe. Today's guest is Gracy Chen, CEO of Bitget. Welcome, Gracy.
Gracy Chen 14:31 ↗
Thank you for having me. Always nice to see you, Laura.
Laura Shin 14:34 ↗
Yeah, nice to see you. Sorry that it's not better circumstances. Bitget was just the victim of a huge hack for a total of $388 million. This bears a number of hallmarks of hacks by DPRK. Let's go back to the beginning. Tell us about that day. I think you found out in the middle of your night. So, first of all, tell us how Bitget figured out that it was being hacked and how you learned about it.
Gracy Chen 15:00 ↗
Sure. Yeah. So, beginning at 6:31 p.m. UTC on September 24, we saw some unauthorized transfers. Actually, 6:31 was the first round of unauthorized withdrawal and that's a very small amount. I think the attacker or the hackers are actually very smart that they just did some testing transfer 0.48 Ethereum from an ETH hot wallet and 93 TRX from a Tron hot wallet. Both were below the risk control threshold and did not trigger a system alert. But at 6:58 UTC that day, the attacker initiated 17... starting from 6:58 actually. So 6:50 is the first timestamp but basically attackers initiated 17 large transfers across different chains and different assets with a total volume of approximately 361 million that were stolen during that time. I figured actually our system figured this out much earlier than I did. So 7 minutes after the first large transfer, our platform's reconciliation system detected a significant discrepancy and the risk system automatically blocked all the user-initiated withdrawals platform-wide. But this didn't really fully stop the bleed because the hackers were very smart that they actually hacked into our internal system using a third-party zero-day vulnerability. So they exploited this vulnerability to gain access to a critical internal management system and then as an impersonated identity they then created some fraudulent withdrawal commands and caused the wallet service to execute those transfers. So the attacker just accessed the wallet-related backend servers and directly inserted fraudulent withdrawal commands into the wallet system. Hence the wallet system sent out some transfers and even if the risk system reacted, that didn't really stop the bleed at that time. But at the same time another thing that the attacker did is also erasing traces and that's why it took longer and became harder for us to identify the root cause. Basically the hackers what they did is after completing the transfers the attacker deleted all the traces that the fraudulent withdrawal commands might have left behind in an attempt to conceal the attack and hinder the root cause identification. So due to the lack of direct evidence we needed to examine a broader range of systems to identify the root cause during this incident. What for me personally I just happened to wake up about one hour after their first major transfer. Well at that time my especially my technology and the security team are already in full house like full steam working on that already but they also haven't really caught me but I woke up myself. That's a coincidence but I'm sure even if I didn't wake up my team might have caught me in about 10 minutes time. So when I woke up that was my 4:00 a.m. and I saw some text messages on the working phone and I started to you know together with our technology team see what we can do. And I also decided to be on a live very quickly because I figured this is a time that the whole community is speculating because all the things are on-chain. People can see there are also external like voluntary-based white hat hackers like SEAL 911. I know their founders Samczsun and a couple of other voluntary white hat hackers. We've already been in a Telegram group for many years because we help each other tracking different funds. There were cases that some fraudulent funds went to Bitget and we helped them freeze. So I saw from that group like the external community are already discussing and asking us. So I wanted to be very upfront answering questions and facing the community directly.
Laura Shin 19:48 ↗
Okay. Yeah. I mean it's really impressive that you got on that live so quickly. And it was sort of reminiscent of when Ben Zhou of Bybit also did something similar. I did want to ask, you know, about the fact that they did the test transactions and also had covered their tracks because I asked Taylor Monahan what she would ask you and she basically asked why there were these transactions that spanned over what she thought was about three hours. Is that accurate?
Gracy Chen 20:26 ↗
Oh, okay. Yeah, that's accurate. The first large transaction as mentioned earlier was 6:58. The last transaction was at 9:23. So that's less than 3 hours from the first testing transfer.
Laura Shin 20:44 ↗
Okay. And so was it because they had covered their tracks that you weren't able to stop that one that happened almost three hours later?
Gracy Chen 20:55 ↗
I think there are mainly two reasons. The first one is what we discussed earlier like finding the roots and doing the remediation took longer. But we did one specific important thing that we also did in between the two rounds of their attack is that there were actually technical containment measures that my technology and security team did. But at that time we cannot rule out the possibility of a private key compromise. So we again switched on certain buttons and allowed the different wallets to make transfers. So what we did is we collected all the money from the hot and warm wallet back to cold wallets and that gave the hacker another chance of doing attack but the amount is much smaller. The total value of the second round of attack is about 30 million and that's from 8:55 to 9:23 because we switched on the system again and allowed them to give them another chance but we needed to do that because there were far more than 30 million on the hot and the warm wallet that we needed to rescue. So there were mainly two rounds and in between there is this important discussion that we needed to make and there are so many possibilities. So a huge difference between Bitget's hack and Bybit's hack is that Bybit's hack the root was quite clear right it's a Safe wallet front-end issue that touched their cold wallet but our issue is very different it's hot and warm wallet and it seems like it can have a lot of different causes and that's indeed why it made it much harder to identify the root cause because it involves a lot of systems and a lot of different public chains.
Laura Shin 23:11 ↗
And then what can you tell us more about the third-party system that was hacked and how that transpired?
Gracy Chen 23:19 ↗
I can't disclose the third-party name nor the exact vulnerability. It is a security product that we used to hopefully make it more secure. But the vulnerability is a zero-day vulnerability. It means it's never been discovered before. But the key thing here is I don't want to blame an external party. We are taking the full responsibility. And we are going to publish an incident report very soon probably today or tomorrow but definitely within a week that can give you more details and give the community more details on this vulnerability itself. But I think in general we've already notified the vendors about their vulnerability. So there are a lot of things that we are doing together and this is still an ongoing incident right. So other than the hack itself right now I think we as a team are looking a lot about number one business and operation-wise how can we win our users back? How can we get all the business as usual and then at the same time watch and trace all the hackers' activity around the money laundering and we actually worked together with a lot of different decentralized protocols. I know you guys covered this yesterday like there were protocols that refused my request of freezing certain addresses not serving the hacker. There are also other DeFi protocols that came out and said, "Oh, we helped you freeze your accounts and we are not interested in the bounty because we want Bitget to recover more." I think right now I see a lot of different faces although they are all doing DeFi protocols and as a community or as an industry participant I really appreciate whoever at this stage are helping us avoid free some of our stolen funds and then not allowing the hackers to easily launder the money.
Laura Shin 25:33 ↗
Okay. And out of curiosity, was the third-party vendor one that is familiar with the threat level for crypto companies? Like was it a security company that also understands kind of just that there's a heightened level of security needed for crypto companies or were they more a general provider?
Gracy Chen 25:58 ↗
They are slightly more general provider. I would say if you are not a crypto company, you might have used their service as well. But again, I think this part is easier if we leave it to the incident report to answer more thorough questions rather than me disclosing too much.
Laura Shin 26:17 ↗
Okay. Well, one last question that I have to ask is whether or not social engineering was involved.
Gracy Chen 26:24 ↗
I can't answer that either. But I can assure you that if it's Lazarus they use social engineering a lot and social engineering is a common threat targeting the whole industry but for this incident exactly I can't answer that question. I'm sorry.
Laura Shin 26:47 ↗
Okay. Okay. Because obviously after Drift that's what's on everybody's mind and that one was so chilling. But I totally understand if you want to wait until you have your fully polished explanation to release. All right. So, we're going to go into more details around which assets were affected and which chains and what happened to the attempt to recover those funds. But first, we're going to take a quick word from the sponsors who make the show possible.
Unknown 27:19 ↗
$540 million. That's how much concentrated liquidity sat idle in a given week in the first half of this year. About 30% of the DeFi TVL if you're wondering. That's according to Dune Research commissioned by 1inch. But there's a solution. 1inch Aqua is the new shared liquidity platform. It lets LPs back multiple positions with the same token balance and keep their tokens in their wallet till a swap comes. Why does that help? Because the LPs don't have to split their tokens across positions. They can cover more market conditions and pairs with their full balance. That means more activity across deeper liquidity. See how it works at 1inch.com/aqua. Remember that providing liquidity carries risk and fees aren't guaranteed. If you like this show, there's another one from our network you should be listening to. Bits and Bips is our twice-weekly market show. On Mondays, Ram Ahluwalia, Austin Campbell, and Chris Perkins chat about where crypto and macro collide. It's sharp, it's fast, and it has its own channel. Search Bits and Bips and subscribe.
Laura Shin 28:28 ↗
Back to my conversation with Gracy. So, as you mentioned earlier, there were a number of affected chains, Ethereum, XRP, Arbitrum, Avalanche, Optimism, BSC, Base, Zcash. And I noticed that Zcash was actually listed a day later maybe or something. And I just wondered why it was not noticed initially.
Gracy Chen 28:56 ↗
I think there were two public chains actually. Is it Zcash and TIA or Zcash and Tron? There were Zcash and another public chain that we later on discovered that's also involved in or affected in this incident because it's a relatively smaller asset and public chain used at our platform. So that wasn't on the first round of attack like the detection. It wasn't really because Zcash is Zcash and Zcash as a privacy coin do have very different features than many other cryptocurrencies, but it's mainly because it's a smaller chain.
Laura Shin 29:41 ↗
Okay. Okay. Yeah, I just was curious about that. So I then also wanted to ask, so I'm sure that the exchange has protocols in place for situations like this. You kind of mentioned earlier the move to transfer a large portion of the funds in the hot wallet and the warm wallet to the cold wallet. So I was curious like if you had any other insight you could give us into what the plan is because obviously the pause on withdrawals I think happened later and I wondered kind of why that wasn't put in place earlier.
Gracy Chen 30:23 ↗
The part of the withdrawal actually were automatically switched on at 7:05, 7 minutes after the first large initial transfer. So we've already like the whole risk system already automatically blocked the user-initiated withdrawals but the part that you were asking in terms of us naming it as a withdrawal pause is slightly later because actually at that time whether we stop withdrawals or not doesn't really make the difference in terms because the hacker is not doing a normal user withdrawal. Hopefully that answers your question. So later on it's more of just users cannot even do the withdraw button and for us the withdrawal paused slightly earlier at 7:05 when the system detected this significant discrepancy.
Laura Shin 31:39 ↗
Okay. So, but then I don't understand how they were able to do the subsequent transactions.
Gracy Chen 31:46 ↗
Because it's not normal user withdrawal. It's at the backend server sort of withdrawal.
Laura Shin 31:53 ↗
Oh, I see. I see. They were just using a totally different mechanism.
Okay. Okay. All right. So, let's now talk about your attempt to recover these funds because obviously I did see that you reached out to a number of different foundations across these affected chains. Some of them had frozen the hackers' wallets and I wondered if you, because there's a lot of discussion on the timeline about which chains can do what and so from your discussions with them I don't know if you could help illuminate what determines whether or not a foundation can freeze wallets or not.
Gracy Chen 32:36 ↗
I don't have much information but I don't have the firsthand expertise on this. I do have another team member actually a few team members who are more hands-on in terms of understanding the mechanism of this public chain and that public chain but I want to highlight like so far there are a few organizations who are being very helpful. Tether, Circle. These two stablecoin issuers are the first two batches of organizations who helped us freeze some stablecoin from our stolen funds. And then yesterday Near Intent also helped us froze another I think it was 550, 500k-ish sort of different crypto that went through the Near protocol. Not the direct Near protocol but the Near Intent sort of swap or swap I think. But basically these three right now are the main sources of organizations that helped us freeze some accounts and some addresses. But I think the recovery is just another story. Recovery is different from freezing. Freezing is slightly easier. Recovery we need to go through a lot more especially legal procedure which we are doing our best. But again I don't think that's a huge source of funds that we are looking at to get back. For example if you look at Bybit's hack after one year the Bybit stolen fund of more than 1.4 billion there were only 3.5% that's frozen and then the part that they got to recover it's much smaller. I just hope that this time we can do better than 3.5%. But I don't have much hope honestly.
Laura Shin 34:37 ↗
Okay. Okay. Yeah. I mean I would imagine so what happened last time was that with Arbitrum they were actually able to freeze 71 million. But that involved getting the Arbitrum security council involved and with Circle and Tether because they're apps on these chains rather than chains themselves, it's just a much easier, quicker decision. But I did want to ask about Circle because they were criticized in the past repeatedly, but especially I feel like for the Drift hack for not acting and instead allowing the stolen funds to move freely. And obviously this time around it was a much smaller amount that they were able to help out with. But why do you think that they or I don't know if you have any insight into why they moved to help at all because that was sort of new for them.
Gracy Chen 35:32 ↗
Well, I didn't follow the Drift case in terms of USDT or USDC or Circle's action that closely. So I don't know the details in terms of how the Drift case is different from ours. All I can tell you is Circle actually moved quite fast in this situation. I don't know if it's because they decided to change some protocol rules or maybe it's because the cases are different. We published all the information very very quickly right we publish a dashboard that follows all the stolen funds addresses and it's still alive. We'll keep it alive a long time. Bybit, Lazarus, they have a Lazarus bounty website that they created right after their hack. Right now if you go to that website the first page dashboard is obviously ours. So there are maybe as an industry we all evolved. But again I don't have the details on the Drift case. So it's hard for me to tell you like why this time is different.
Laura Shin 36:43 ↗
Okay. Okay. Yeah. Well yeah it's definitely noticeably different because we actually did a whole episode on how they did not act at all for $280 million or something like that. So yeah I was surprised to see that this time. There's another actor who appears to have changed his stance during this incident and that's Zach XBT. Earlier this year he tweeted about I mean there were a number of these but he tweeted about some pump and dump activity that he saw that he felt originated on Bitget also on Gate and Binance. He tweeted Shaunlu is the big big boss who allows these scams to operate behind the scenes while Gracy Chen is only the face of it. The Chinese exchange cartel has gone unchallenged for years and doesn't care as long as they benefit from the activity. And then he said I think it's almost time to increase public attacks against Bitget. And later he tweeted about a token lab token which he called a market manipulation scheme via spot. And he was saying that he thought 95% of the supply was held by insiders. And again during that he was calling out Bitget because I guess he traced that a number of the insiders had withdrawn almost $500 million from Bitget. So last week after news of the Bitget hack went out he initially tweeted I have no current plans to monitor the Bitget exploit by DPRK. I stopped wasting my time on helping people in the industry who are not supporters of my work, donors, clients, longtime followers, etc. So it sort of seemed he was like throwing shade on your exchange. But then on
Monday he tweeted that he saw Chinese illicit actors trying to launder funds for DPRK from the Bybit hack, asking for help in Discord. He identified five aliases that were being used. He, you know, revealed the transactions that were tied to those aliases. So I was curious, like, what happened in between the initial announcement that he wasn't going to work on this and then, you know, the time when he actually noted where some of the funds had gone.
Gracy Chen 38:59 ↗
I don't know, you should ask Zach this question. We did talk to him and among many other on-chain researchers, voluntary, like those white hat hackers that I told you about, and some formal companies such as SlowMist and Mandiant that we formally engaged, and they are helping us independently research and come up with an incident report. So our team actually — I didn't talk to Zach directly, but we do have a dedicated team that consists of technology team, blockchain experts from our team, listing team who know a lot of people in this industry, that they are working together to talk to on-chain researchers. I don't think we formally sort of like paid Zach a retention fee to start an investigation, nothing like that. So maybe he is just, you know, looking at the so-called Chinese illicit actors laundering money and he finds it hilarious. I actually saw that post and when I saw the Discord conversations, I also found it quite hilarious. Like you saw someone said, you know, you chose the wrong job, pal. And I made a fun comment on Zach's Twitter post saying, yes, indeed they chose the wrong job. But other than that, we're not like formally engaging Zach. But I do appreciate him and anyone right now in this industry who cares and who are working together to make it very hard for the hackers to launder our stolen funds.
Laura Shin 40:55 ↗
And do you have a response to his allegations from a few months ago where he felt like these pump and dump schemes were either originating on your exchange, but then also, you know, some of the teams were cashing out from your exchange?
Gracy Chen 41:08 ↗
Well, all these cryptocurrencies, if you look at many of the names that he specified, they are all listed on many exchanges. They are typically also listed on Binance and on, you know, Gate, Bybit, OKX, like all the top exchanges sort of have listed this token. So I can't really respond to him saying, you know, pump and dump only happened at Bybit because it's available on many exchanges. And then maybe we can discuss further in another chance after I get a chance to look at the specific pump and dump activity that he is referring to. But right now I don't have a response on that.
Laura Shin 41:58 ↗
Okay. And from his identification of those aliases in the transactions, did that enable you to either get some of the funds frozen or even recovered?
Gracy Chen 42:10 ↗
For this one particularly, I don't know because this post that he tweeted was only yesterday, and I have a team who are covering this which they haven't told me specifically about whether this particular information is helpful or not. I know the Near Intent thing because they updated me that it's quite useful and they are approaching — like my team is approaching Near Intent. They have a TG group set up already. They are discussing the exact procedure we should take from our legal end in order to, you know, hopefully recover those funds. So those are some things that I'm updated, hence I know. For the Zach part, I'm not updated, so I don't know yet.
Laura Shin 42:58 ↗
Okay. So yeah, well, why don't we talk more about Near Intent. So this is going to be a setup for kind of a contrast that we're seeing from different teams in the industry to this hack. So go ahead and talk about what it is that Near Intent did that was so helpful for you.

34 more exchanges in this transcript

Sign in free to read the rest of this interview. No card required.

Sign in to read the full transcript

Cite this transcript

APA, MLA, BibTeX
APA

Chen, G. (2026, September 29). Inside Bitget's $388M Hack: How the Attackers Got In [Interview transcript]. Unchained. CEOInterviews.AI. https://ceointerviews.ai/interview/2950092/

MLA

Gracy Chen. "Inside Bitget's $388M Hack: How the Attackers Got In." Unchained, 29 Sep. 2026. Transcript, CEOInterviews.AI, https://ceointerviews.ai/interview/2950092/.

BibTeX
@misc{chen2026_2950092,
  author       = {Gracy Chen},
  title        = {Inside Bitget's $388M Hack: How the Attackers Got In},
  howpublished = {Interview transcript, Unchained. CEOInterviews.AI},
  year         = {2026},
  month        = {sep},
  url          = {https://ceointerviews.ai/interview/2950092/},
  note         = {Speaker-attributed transcript with timestamps}
}