Bitget CEO Gracy Chen Breaks Down $388M Hack

Key topics
- Attacker exploited a third-party zero-day to steal $388M from hot and warm wallets.
- All user balances fully protected by Bitget's $465M user protection fund.
- Protection fund to be replenished above $300M within one week.
- Attacker's identity to be addressed in a formal incident report.
- ThorChain declined to block stolen funds, citing permissionless design.

Outline

00:00 - Introduction
01:07 - Withdrawals Resume
02:31 - The Hack: Full Recap
05:57 - Attack Timeline & Steps
11:12 - North Korea Link?
13:07 - ThorChain & Laundering
17:00 - Industry Support & Shoutouts
21:25 - Law Enforcement & Regulators
24:47 - Protection Fund & Replenishment
28:11 - Solvency & Operations
29:11 - The Road Ahead

Summary

Bitget CEO Gracy Chen joins Gareth Jenkinson on The Starting Block to discuss the $388 million hack of Bitget's hot and warm wallets and how the exchange will cover all user losses.

Gracy recalls the events of the attack, explaining that it began September 24, 2026, with test transactions of ETH and TRX that fell below alert thresholds. Around 30 minutes later, numerous large transfers across XRP, ZEC, BSC, Base, Arbitrum, Optimism, Avalanche and other chains drained the equivalent of roughly 361 million USDT before systems flagged it some minutes later and froze withdrawals. Chen explained that the attackers got in through a flaw in an outside security tool, used it to gain internal access, and pushed withdrawals through without setting off the usual checks. They then tried to cover their tracks. She stressed that private keys and cold storage were never touched. Outside firms are now helping with the investigation, and Bitget shared its early onchain findings within a day. As for who was behind it, Chen said she'd wait for the full incident report before pointing fingers.

Chen said ThorChain told her that, like Bitcoin and Ethereum, it could not intervene, and called it a repeated laundering route, including in Bybit's case. She thanked Tether and Circle for freezing part of the stolen assets, SEAL 911 for alerting her team within 90 minutes, and industry peers including Binance and OKX.

Bitget's user protection fund, set up in 2022 and worth about 465 million USDT on the day of the hack, will cover all stolen balances. It will be replenished to at least 300 million within a week from corporate reserves, which an August 31 audit put above 1.4 billion. Bitcoin withdrawals reopened Monday, with Ethereum withdrawals set for Tuesday.

About the guest
Gracy Chen is the CEO of Bitget, a major cryptocurrency exchange and Web3 company that ranks among the top platforms for derivatives trading by volume. A passionate advocate for diversity in the Web3 space, Chen is a delegate at the UN Women CSW conference. Under her leadership, Bitget launched the Blockchain4Her initiative, committing $10 million to promote gender diversity and inclusivity in the blockchain industry. She holds a Bachelor's Degree from the National University of Singapore (NUS) and an MBA from the Massachusetts Institute of Technology (MIT).