How Bitget Is Chasing $388 Million in Stolen Funds After a Zero-Day Hack
How Bitget Is Chasing $388 Million in Stolen Funds After a Zero-Day Hack
1 hour ago•Unchained•Laura Shin
Podcast1 hr 6 min
Listen to Episode
Note: AI-generated summary based on third-party content. Not financial advice. Read more.
Quick Insights
  • Treat Bitget as a watchlist item, not an IPO opportunity yet: no firm listing date or ticker is available, and assess its security upgrades, recovery progress, and protection-fund transparency before considering exposure.
  • Don’t infer a buy or sell signal for BTC, ETH, or the other named tokens from this incident; the insights provide no price targets or asset-specific catalysts.
  • If considering 1inch Aqua or other DeFi liquidity provision, account for the risk of loss and the possibility of earning no fees; the cited idle-liquidity estimate does not guarantee better returns.
Detailed Analysis

Bitget (private company; potential IPO)

  • Bitget reported a hack involving approximately $388 million in stolen assets. The attacker exploited a zero-day vulnerability in a third-party security product to access internal wallet systems and initiate transfers.
  • The exchange said its protection fund was valued at about $556 million at the time of the interview and that it planned to keep the fund above a $300 million threshold.
  • Bitget said a potential IPO remains on its roadmap, but the hack had not changed its major financial plans. No public ticker or firm IPO commitment was provided.
  • The CEO said withdrawals resumed in stages and described lower-than-expected withdrawals; ETH inflows briefly exceeded outflows after withdrawals reopened. This is a short-term operational snapshot, not evidence of a lasting recovery in customer confidence.

Takeaways

  • For anyone assessing a possible future Bitget listing, the incident makes custody controls, third-party vendor oversight, transparency, and the strength and accessibility of the protection fund important due-diligence areas.
  • The exchange said it was strengthening third-party checks, isolating systems, resetting credentials, and requiring multiple approvals for critical operations. The incident report and follow-through on these changes would be important to evaluate.
  • Bitget’s stated IPO timeline is a possibility on its roadmap, not a specific recommendation or confirmed offering.

Bitcoin (BTC)

  • Bitget said the protection fund is held mainly in Bitcoin and reported moving some of it to its hot wallet to support withdrawals.
  • The exchange said Bitcoin withdrawals had resumed before the interview.

Takeaways

  • Bitcoin was discussed primarily as part of Bitget’s reserves and withdrawal operations; the transcript offered no price outlook or direct view on Bitcoin’s investment merits.
  • For exchange customers, the episode underscores that an exchange’s reserves and withdrawal operations are separate considerations from the investment case for BTC itself.

Ethereum (ETH)

  • ETH was among the assets involved in the hack. The first small test transfer was 0.48 ETH, followed by larger unauthorized transfers.
  • Bitget said ETH withdrawals resumed during the interview. It reported that, after reopening, inflows briefly exceeded outflows: about 9,674 ETH in versus 9,023 ETH out in the period it described.

Takeaways

  • The withdrawal figures provide a limited snapshot of activity after reopening, not a reliable signal about ETH’s price direction or Bitget’s longer-term customer retention.
  • The incident highlights the need to assess the security of platforms holding ETH, in addition to assessing the asset itself.

Tether (USDT) and USD Coin (USDC)

  • Bitget said Tether and Circle, the issuers of USDT and USDC, helped freeze some stablecoins connected to the stolen funds.
  • The CEO said freezing assets is distinct from recovering them, which may require additional legal procedures.

Takeaways

  • The episode shows that stablecoin issuers may be able to freeze certain funds in response to a suspected theft, but that does not guarantee those funds will be returned.
  • The transcript does not provide a broader investment view on USDT or USDC.

NEAR (NEAR) and NEAR Intents

  • Bitget said NEAR Intents helped freeze roughly $500,000 in crypto routed through its swap service.
  • The CEO described NEAR Intents’ “Shield” system as using transaction and risk signals to identify suspicious flows. She praised its approach of combining permissionless access with measures against laundering stolen assets.

Takeaways

  • NEAR Intents was presented as an example of infrastructure designed to monitor suspicious transaction flows. The transcript does not establish how much stolen money will ultimately be recovered.
  • For investors considering crypto infrastructure projects, the episode highlights security tooling, compliance processes, and incident response as relevant factors to assess.

THORChain (RUNE)

  • Bitget asked THORChain not to process transactions from addresses associated with the hack. The CEO said she had not received a firm response or had a direct discussion with the protocol’s core developers.
  • She said she did not know exactly how THORChain’s governance and ability to intervene worked, while noting that the protocol had previously shut down in response to other incidents.

Takeaways

  • The discussion highlights a practical trade-off for decentralized protocols: permissionless access can conflict with attempts to block the movement of stolen assets.
  • The transcript does not resolve what THORChain could technically or governably do in this case, so it provides no clear investment signal for RUNE.

XRP (XRP), TRON (TRX), Arbitrum (ARB), Avalanche (AVAX), Optimism (OP), BNB Chain (BNB), Base, Zcash (ZEC), and Celestia (TIA)

  • Bitget identified these networks or assets among those affected by the incident. Base was named as a network; no Base token was mentioned.
  • The exchange said it identified Zcash and another relatively small chain later because they were smaller parts of its platform activity—not because Zcash’s privacy features caused the delay.
  • The transcript also mentioned Zcash and Monero as privacy coins that can be used in laundering activity generally; it did not connect that statement to a specific investment outlook.

Takeaways

  • These assets and networks were discussed in the context of incident tracing, not as investment recommendations or as having a shared outlook.
  • The episode illustrates that exchanges supporting many networks face operational complexity when investigating an incident across multiple chains. The transcript provides no price targets or asset-specific catalysts for these tokens.

Zcash (ZEC) and Monero (XMR)

  • The CEO cited Zcash and Monero as examples of privacy coins that may be used in laundering schemes. She also said Zcash was identified later in Bitget’s incident investigation because it was a smaller asset and chain on the platform.
  • No claims were made about either coin’s price, adoption, or investment potential.

Takeaways

  • The comments identify regulatory, monitoring, and reputational scrutiny as considerations for privacy-focused assets, but they do not establish any specific outcome for either cryptocurrency.
  • The transcript offers no basis for a directional investment recommendation on ZEC or XMR.

1inch Aqua and DeFi liquidity provision

  • A sponsor segment described 1inch Aqua as a shared-liquidity platform that lets liquidity providers back multiple positions using one wallet balance and keep tokens in their wallets until a swap fills.
  • The sponsor cited research estimating that $540 million in concentrated liquidity sat idle in a given week in the first half of the year, around 30% of DeFi total value locked.
  • The sponsor explicitly warned that providing liquidity carries risk and that fees are not guaranteed.

Takeaways

  • Shared liquidity may help providers use capital across more positions, but the transcript does not establish that this will improve returns for an individual user.
  • Anyone considering liquidity provision should account for the stated risks and the possibility of earning little or no fees.

Crypto exchange security and DeFi risk

  • Bitget said only about $632,000 of the approximately $388 million stolen had been frozen at the time of the interview. It also described recovery as more difficult than freezing and potentially dependent on legal procedures.
  • The CEO highlighted third-party vulnerabilities, social engineering, and the challenge of tracking funds across networks. She also described efforts to improve vendor checks, access controls, and industry coordination.

Takeaways

  • Exchange and protocol security, third-party dependencies, and incident-response procedures are material risks across crypto—not just for the specific assets involved.
  • A platform’s ability to freeze funds should not be assumed, and freezing does not necessarily mean recovery.
Ask about this postAnswers are grounded in this post's content.
Episode Description
Bitget lost $388 million — and days later, CEO Gracy Chen says scammers posing as a major investment team targeted her. ======================================================== Thank you to our sponsor! ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠Visit⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ 1inch.com⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ to swap tokenized securities, crypto and more. Simple. Secure. Self-custodial. Whatever asset you’re buying - swap it at⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ 1inch.com⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ ======================================================== Quick favor: We're deciding what Unchained does next; new shows, stream times, what's worth paying for.⁠⁠ Our listener survey⁠⁠ takes five minutes, it's anonymous, and I read the write-in answers myself. Everyone who takes it can enter a drawing for a free year of Unchained Premium or Bits + Bips Premium. Open through Sunday, October 18. — Laura ======================================================== On September 24, attackers used a zero-day in a third-party security product to slip fraudulent withdrawal commands into Bitget's wallet system, pulling out about $388 million across chains from Ethereum and XRP to Zcash. Bitget CEO Gracy Chen joins Laura Shin to reconstruct the attack, from test transfers that stayed under risk thresholds to her team's call to switch wallets back on mid-attack and sweep hot and warm funds into cold storage. She lays out how the exchange's protection fund covered users and why reopened withdrawals showed an early net inflow. Then comes the industry response. Tether, Circle, and NEAR Intents froze funds, THORChain declined her request, and only $632K is frozen so far. Chen also describes scammers impersonating an investment firm to target her after the hack. Her case that "permissionless doesn't mean neutral" puts a hard question to DeFi. Host: ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠Laura Shin⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠, Host / Unchained Guest: ⁠Gracy Chen - CEO of Bitget Timestamps 🚨 01:50 How attackers used a third-party zero-day to fake withdrawal commands ❄️ 07:15 Why Bitget switched wallets back on mid-attack to sweep funds to cold storage 💧 14:30 1inch Aqua: See how LPs back multiple positions with the same token balance at http://unchainedcrypto.com/go/1inch-sn ⛓️ 15:37 Why the hackers were able to transact even after withdrawals were paused 🧊 19:04 How Tether, Circle, and NEAR Intents froze funds, and why recovery is harder 🕵️ 24:05 ZachXBT's shift on the Bitget hack and his earlier pump-and-dump claims 🛡️ 30:01 NEAR Intents vs. THORChain: does permissionless mean neutral? 💰 41:55 Why Bitget built its protection fund in 2022 and how it covered the loss 🎭 48:17 How scammers posed as an investment team to target Gracy after the hack 📈 01:01:32 A net ETH inflow after withdrawals reopened, and whether the IPO is still on Learn more about your ad choices. Visit megaphone.fm/adchoices
About Unchained
Unchained

Unchained

By Laura Shin

Crypto assets and blockchain technology are about to transform every trust-based interaction of our lives, from financial services to identity to the Internet of Things. In this podcast, host Laura Shin, an independent journalist covering all things crypto, talks with industry pioneers about how crypto assets and blockchains will change the way we earn, spend and invest our money. Tune in to find out how Web 3.0, the decentralized web, will revolutionize our world. Disclosure: I'm a nocoiner.