Bitcoin Could Swing 30% Either Way In The Next Two Months | Gracy Chen

Good, good, thank you. It's been a few weeks already, so very much settled business as usual. Was having a long trip in Singapore last week for Token2049 this year and F1 afterwards, and then more settled down now.

Yeah, so you might have heard of this many times already. The incident started at UTC time, September 24th, 6:30 p.m. Actually 6:31 exactly. And in my GMT+8 time zone, that's actually 2:30 a.m. And indeed we have some higher executives based in Asia, so that was our midnight. And I think the hackers chose a time like that, so they were expecting maybe us taking a long time to respond. But for us, we actually responded pretty quickly. When we saw the unauthorized transfers, especially like the large ones happening, our system — not when I say we see it, not like us human beings, more like the system — have already detected it and reacted and started not allowing anyone to withdraw. And during the first few hours we've already identified the problem, there were immediate priority containment. We also made a decision that at the very first few hours that we will make all the users whole. We as a company will bear all the financial impact of this incident.

For me, I started off about one hour after the first strange withdrawal happening by the hacker. So that's like 3 something a.m. my time. Weirdly, I woke up just naturally that day. I wasn't called at that time yet because at the initial one hour or so it's mainly the technology and security and product team reacting. And then just within hours we all, especially the higher executives, all wake up. I started live streaming about three hours after the incident and I just wanted to be very transparent with the community because at the time, blockchain things, everything is public, it's on-chain, people get to see, so people were texting us and asking why. So I figured it's just easier to do a live stream and share all the information we have at that moment. And during the three plus hours of that live, we together as a company discovered further information about, for example, our private key not compromised, our cold wallet wasn't touched. Those information were just gradually discovered or confirmed, and I get to also share more information with the public whenever I have them.

The attack started off as a previously unknown, which in technical terms is defined as a zero-day vulnerability in third-party security products. And the hackers obtained high-level internal credentials and made certain transfers that's not authorized by us but by them. So we've already confirmed some interim findings published by independent security firms like SlowMist and Mandiant, so you guys can refer to that for more details. But basically, the credentials were used to send fraudulent withdrawals in total of about 388 million transferred to attacker-controlled addresses. What that is not is, firstly, I mentioned private key not compromised. That wasn't like Bybit's case when the root problem was easier to identify in their case, but in our case it's more complicated because it involved a few different chains with different currencies and it's not just like a single wallet issue. So we took a slightly longer time to find out exactly what happened and also replenish everything. What other things it is not, maybe I mentioned earlier like private key, cold wallet. I think those are the two most serious things that we thought about, and I was relieved to know that these are, like, the foundation at least is not compromised. And again, this is an external security attack. We've done internal and external, and with our independent third-party investigator together, we don't think it involved internal sort of attack. It's more of external attack, and of course it's also fundamentally different from, for example, what happened in FTX, like the misuse and commingling of users' funds.

I want to clarify, so it doesn't mean our infrastructure is perfect. They exploited the infrastructure through the third-party vulnerability, but ultimately still them using our infrastructure to make those transfers.

If it's a necessary evil, we want to contain any evilness that could happen. So the broader lesson is any vendor with especially privileged access is part of our security. We can't treat them just like a third party that, oh, it's not my business and I don't care that much, and as far as you serve me well, it's done. So we've already, after the incident, strengthened our approach in a few areas, like we've done more rigorous assessment of all the third-party products, whether it was part of the incident or not, and also more additional safeguards around the deployment and continued and enhanced monitoring of any abnormal activities. But I don't think any exchange, especially because our business is quite comprehensive, that we can do everything by ourselves, and even if we do that, it may not be as good as using third parties. So we still need the vendors and third-party products, but we need to have really rigorous checks, assessments, safeguards, continued monitoring. And again, it is hard, because systems like this kind of security thing, for us who are guarding or defending, you can't have any error, or not even error, but any sort of vulnerability, right? Because that gives your enemy a chance. But for the enemies, as far as they can find one vulnerability, they are in. So it's not a fair game, if I can put it that way. But again, for us, we're still taking full responsibility for that by, you know, building a stronger system and more secure system.

Correct. Yeah.

First of all, all the money comes from Bitget company capital. So, Scott, you know me for a while and you know that I joined Bitget in early 2022. And in that year, if we call back, you know, four years ago, it was quite a bear market. The end of the year there was FTX collapse, but earlier in that year, actually for me just after one week of me joining Bitget, there was Luna collapse and then Celsius, 3AC, like all these pretty big companies went down. So even before FTX collapse, we've already established this protection fund, and this was established by, number one, capital, the capital from the company, but also number two, established for any sort of issues like that. Sorry. Yeah, there were also some smaller exchanges running away. So we find this is, you know, simple, even a little bit like a grassroots sort of way, just to establish a protection fund and have them in an open wallet so that our users can see them. So it was established in 2022 for something like this, and then when we used this protection fund, we've also replenished it already above 300 million.

Yeah. So, right after the incident, we've used the protection fund to replenish any loss of those hot and warm wallets. And then within a week, we replenished the protection fund back to 300 million, which was the initial promise. Even not, I mean, the initial promise, if I remember correctly, was 200 mil, but in 2024-ish, we told the industry or the community that we're going to keep this protection fund above 300 mil. So this time when we used the protection fund, it went down to somewhere 200, and then we replenished it back to 300 mil again using the company's capital. So you can see those activities actually on-chain. And then for our users, they can do Merkle tree proof of reserve on their own funds and know that their own funds are still part of the Merkle tree. And we've also published another special round of the Merkle tree proof of reserve right after the incident so that users feel more comfortable and knowing, you know, what's your proof reserve rate, which I think is 131% at that time. While we obviously publish proof of reserve on a monthly basis after FTX collapse, and we've been doing that for almost four consecutive years. So that extra one was mainly after the incident and just to clarify some questions that our users may have.

If I can be very precise, there is no formal attribution, but I did say in our, in the very first hours doing the live, that when we look at the VPN and how the hackers launder those money, it does look very, very similar to how Lazarus usually act. So it's not like a formal attribution, but I do still stand with what I said before. And there again, like for the details of the security issue itself, SlowMist and Mandiant published something, but they also didn't publish anything about the hackers' attribution. But on the broader question, I think yes, it's a very specific hard group of people that's like targeting this industry, and I've been seeing the industry making progress, but they are still, if you look at how they attack, right, like they are more targeting credentials, process, and trusted tools rather than maybe originally mainly about private keys. Now we've done pretty good guarding of private keys, cold wallets, etc. But no exchange can address this alone, and I think as an industry we need to share intelligence around threats. We need to have a lot of fast coordination, especially when we are tracing illicit funds. I've seen a little bit of improvements on that, but just looking at how our funds, once it's stolen, how it's laundered, I do think as an industry there is still a long way to go. So for example, the freezing part of our stolen fund is still at a very minimum number of maybe multi-millions out of the 388 million that we were stolen of, maybe just slightly barely one or two million at the moment that can be frozen. And the commitment among the whole industry to treat security as like a core function of the business is very key, especially for exchanges. Like on day one, you need to build your exchange with the mindset that knowing they are targeting you, they will be targeting you, especially if you grow bigger and have a lot of users and custodian funds, etc. So I think that's a very important mindset, and as an industry, there's growth, progress, but we still need to work more.

Well, there are of course a lot of partners that I would love to appreciate or attribute some of the efforts to them. For example, NEAR Intent, for example, Tether and Circle also reacted pretty quickly, especially on the first day, although later on it's not that quick anymore. And also, for example, Bybit, we've exchanged a lot of intel. We learned from how they were able to freeze some of the stolen funds and hopefully get them recovered, but the recovery process may take years. So I don't, I'm not counting on that to at least, you know, recover our funds quickly. So it's still again protection fund and company's capital covering the losses. But in general, for us, the changes are around, number one, we talked about third-party securities and how that part of the risks are managed. But other than third parties, we also strengthened our internal credentials, especially around the withdrawal. We've revoked all the previous credentials and restructured them. We've also restructured the whole wallet withdrawal sort of process so that it's not the same, and we reshift everything like frequently. So it's just, you know, I think we do need to, again, I've seen some effort again from our industry, from Bybit, from NEAR, from Tether, Circle, but there could be more things. But for us, we are more focused on, number one, building the security now, more now, and also back to normal, more about the business, because above all we are still an exchange that's, you know, doing this business together, and it's a very competitive market, especially after 2024 when maybe spot ETF was launched, some of the institutional clients have more choices rather than just using exchange. So it's still a very competitive area or sector, and we want to rebuild trust, we want to rebuild a very strong security system. We also want to, you know, rebuild the business. Well, although the business is not impacted hugely, but of course some negative impact.

Yeah. So in total, on the 25th and maybe until now, we've seen multi-hundreds of millions of fund withdrawal from our platform, which hasn't come back yet. But actually on the second day, the withdrawal was pretty much ended because all of those major withdrawals were happening on the first day when people are very FOMO. But on second day, we started even to see more capital coming back or more inflow rather than outflow. To those users, I would say, number one, your balance was never affected, and then the protection fund covers every loss, and you can check those information on-chain. The proof of reserve shows 131% total coverage, so every asset is about 100%, meaning users' funds are totally covered. And for those who, you know, still want to take some time and think about, you know, how they custody their wallets, maybe from Ledger, you also realize self-custody has its own other set of issues. We can take a 300 mil plus sort of hit as a company because we are pretty big, we are like top three or top four by trading volume globally among all the exchanges. But it won't be something a retail user can easily take or absorb. So for me, I would say, seeing how we reacted, how we managed the crisis, and how we put our users' funds or users' interest in front of everything, I can't really promise that there will never be another attack, and I believe no platform can responsibly promise that. But what I can promise is transparency, is, you know, our professional ways of dealing it, and again, put our users' interest in front of everything.