Uneasy Money: The $388M Bitget Hack Started With a Security Vendor

Bitget’s loss was estimated at $388 million, nearly $400 million, after attackers exploited a code vulnerability in a third-party security product the exchange used. Taylor Monaghan said alerts detected unusual movements from major exchange wallets, but the wallets were not fully drained, so the signals did not immediately confirm a hack. The attackers accessed some Bitget systems, not its private keys, and inserted or spoofed withdrawals in the queue without triggering risk alerts or monitoring. Bitget and SlowMist had issued preliminary forensic reports, but the cause was not fully understood a few days after the incident.

Monaghan described Bitget’s withdrawal process as spanning multiple systems, risk controls, monitoring, and cross-checking nodes, underscoring how a security vendor’s practices can affect its customer’s defenses. He considered it preferable that attackers had to penetrate complex systems rather than obtain an exposed private key. Ken Work questioned whether adding complexity necessarily improves security when operators may not fully understand the systems. Work said Bitget publicly reassured users that it had enough money to absorb the loss.

The discussion also focused on why Arbitrum did not freeze the stolen funds. A speaker said the attackers moved them off Arbitrum quickly, before news spread widely, leaving too little time for the security council to reach consensus. Councils may have to debate each freeze from scratch without a standing policy; a fixed threshold could, however, encourage attackers to steal just below it. Speakers disagreed over whether non-intervention reflects decentralization or a choice: one argued that Arbitrum’s earlier intervention showed it could alter balances, while acknowledging that faster or automated action carries trade-offs. Thorchain’s repeated halts and asset reallocations were cited as evidence of its ability to intervene, though speakers disputed whether that makes it comparable to Bitcoin or Ethereum. One speaker called Thorchain centralized, citing halts, private-Discord distribution of node software, and alleged use as a route for hacks and laundering; those were presented as that speaker’s judgments.

Monaghan said AI is allowing code complexity to grow faster, widening the attack surface. Another speaker predicted AI would eventually write more secure code than people, but put that transition two or three years away. A speaker described a red-team test in which regular GLM 5.3 found eight bugs in a historical synthetic smart-contract corpus and expected a more aggressive fine-tuned version to find more by chaining exploits. They characterized Anthropic’s article about the model as effectively advertising it as “unnerfed.” The episode also discussed a trade-off in AI economics: falling costs could let organizations gain efficiency, but users may pay more as subsidies recede. One speaker said switching roughly 100 agents from Codex subscriptions to API billing cost about $400 in 90 minutes, possibly more than two $200 subscriptions, and argued API pricing remains too high for enterprises to use agents freely.

Speakers differed on whether speculative, loss-making AI companies should go public to raise the capital they need or stay private until they are safer. One argued that exchange listings may be the only route to the required funding, leaving retail investors exposed to substantial losses but also potential gains; the speaker framed the stakes as a possible $2 trillion loss if companies fail or $20 trillion in gains if they succeed. Another said private investors have captured much of the upside before IPOs over the past 15 years, though speakers disagreed about public investors’ returns from companies such as Meta, Google, and Amazon. Pablo argued that major technology companies commonly lose money before becoming large and that private funds squeeze companies before IPOs. He expects AI tools to become highly profitable as businesses use them to improve efficiency, while speakers also warned that retail investors could lose their entire investment.

On Ethereum, speakers called Vitalik’s essay about the network’s future highly bullish if its proposed system can be built, while stressing uncertainty about feasibility and timing. They differed on whether delays stem more from uncertainty about what to build or the difficulty of implementation, but described coordination as central. Coding agents and rapid prototyping could help teams test ideas and decide faster, provided safety limits prevent changes that could break the blockchain; one speaker said roughly 90 percent of prototypes need not ship to make the process useful. Speakers said Ethereum’s perceived expense, uncertain future, and fewer incentive programs pushed applications toward Layer 2s and other Layer 1s, even though one speaker considered building on Ethereum easy and cheap. They argued incentives can distort deployment temporarily, but builders may return if they see Ethereum as the best place to build.