How Bitget Is Chasing $388 Million in Stolen Funds After a Zero-Day Hack

Bitget lost $388 million — and days later, CEO Gracy Chen says scammers posing as a major investment team targeted her. ======================================================== Thank you to our sponsor! ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠Visit⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ 1inch.com⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ to swap tokenized securities, crypto and more. Simple. Secure. Self-custodial. Whatever asset you’re buying - swap it at⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ 1inch.com⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ ======================================================== Quick favor: We're deciding what Unchained does next; new shows, stream times, what's worth paying for.⁠⁠ Our listener survey⁠⁠ takes five minutes, it's anonymous, and I read the write-in answers myself. Everyone who takes it can enter a drawing for a free year of Unchained Premium or Bits + Bips Premium. Open through Sunday, October 18. — Laura ======================================================== On September 24, attackers used a zero-day in a third-party security product to slip fraudulent withdrawal commands into Bitget's wallet system, pulling out about $388 million across chains from Ethereum and XRP to Zcash. Bitget CEO Gracy Chen joins Laura Shin to reconstruct the attack, from test transfers that stayed under risk thresholds to her team's call to switch wallets back on mid-attack and sweep hot and warm funds into cold storage. She lays out how the exchange's protection fund covered users and why reopened withdrawals showed an early net inflow. Then comes the industry response. Tether, Circle, and NEAR Intents froze funds, THORChain declined her request, and only $632K is frozen so far. Chen also describes scammers impersonating an investment firm to target her after the hack. Her case that "permissionless doesn't mean neutral" puts a hard question to DeFi. Host: ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠Laura Shin⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠, Host / Unchained Guest: ⁠Gracy Chen - CEO of Bitget Timestamps 🚨 01:50 How attackers used a third-party zero-day to fake withdrawal commands ❄️ 07:15 Why Bitget switched wallets back on mid-attack to sweep funds to cold storage 💧 14:30 1inch Aqua: See how LPs back multiple positions with the same token balance at http://unchainedcrypto.com/go/1inch-sn ⛓️ 15:37 Why the hackers were able to transact even after withdrawals were paused 🧊 19:04 How Tether, Circle, and NEAR Intents froze funds, and why recovery is harder 🕵️ 24:05 ZachXBT's shift on the Bitget hack and his earlier pump-and-dump claims 🛡️ 30:01 NEAR Intents vs. THORChain: does permissionless mean neutral? 💰 41:55 Why Bitget built its protection fund in 2022 and how it covered the loss 🎭 48:17 How scammers posed as an investment team to target Gracy after the hack 📈 01:01:32 A net ETH inflow after withdrawals reopened, and whether the IPO is still on Learn more about your ad choices. Visit megaphone.fm/adchoices