Inside The First 3 Hours Of A $388 Million Crypto Hack | Bitget CEO Gracy Chen

Bitget’s incident began on September 24 at 6:31 p.m. UTC, which CEO Gracy Chen gave as 2:30 a.m. in her GMT+8 time zone. The exchange detected unauthorized transfers and began preventing withdrawals. Chen joined the response about an hour after the first suspicious withdrawal and started a livestream roughly three hours after the incident began. Attackers sent about $388 million to addresses they controlled.

Chen said the attackers exploited a previously unknown zero-day vulnerability in a third-party security product to obtain high-level internal credentials. Bitget’s private key was not compromised, she said, and its code wallet was not touched. Internal and external investigations found no evidence of an insider attack; Chen characterized the incident as an external attack exploiting a third-party vulnerability through Bitget’s infrastructure. She did not formally attribute it to Lazarus, though some VPN activity and laundering patterns resembled the group’s usual behavior.

Within the first few hours, Bitget decided to absorb the financial impact and make users whole. Chen said the company used its protection fund, created with company capital in 2022 before the FTX collapse, to cover losses in hot and warm wallets. No user lost money and user balances were unaffected, she said. The fund is held in an open wallet; after the incident it fell to roughly $200 million, then Bitget replenished it to $300 million within a week using company capital.

A special post-incident report showed a 131% proof-of-reserves ratio. Chen said Bitget publishes reserves monthly and had done so for nearly four consecutive years. She described those disclosures alongside the use of the protection fund as part of how the company addressed user concerns about whether it could cover the losses, while making clear that the fund had to be replenished after the attack.

Bitget revoked and restructured internal credentials, strengthened withdrawal credentials, and redesigned its wallet-withdrawal process. Chen also said the company tightened checks, deployment safeguards, and monitoring for third-party products. Her security lesson was that vendors with privileged access must be treated as part of an exchange’s security perimeter, even though exchanges still depend on external tools. The episode therefore raised a risk that cannot be addressed solely by protecting an exchange’s own code and keys.

By the time of the interview, Chen said only about $1 million to $2 million of the roughly $388 million stolen had been frozen, and recovery could take years. She credited Near Intents, Tether, Circle, and Bybit with contributing to response efforts or sharing intelligence, and argued that exchanges need to coordinate quickly to trace and freeze illicit funds. Bitget saw several hundred million dollars in withdrawals that had not returned; most outflows came on the first day, while inflows exceeded outflows on the second.

Chen said no platform can responsibly promise that another attack will never happen. She pledged transparency, professional crisis management, and a focus on users’ interests, while acknowledging the limits of what could be recovered so soon after the incident.