Bitget CEO Gracy Chen: Hacker Incident Only Frozen About $1.1 Million in Funds, Protection Fund Has Recovered

According to CNBC, Gracy Chen, the CEO of cryptocurrency exchange Bitget, revealed that in last week's security incident involving nearly $388 million, only about $1.1 million of the involved funds have been successfully frozen. She made it clear that asset freezing does not equate to a full return to the platform, and the exact amount recovered has not yet been disclosed.

During an interview with CNBC on Wednesday, Gracy Chen admitted that based on past industry experiences with such hacker incidents, the actual amount of funds that can be recovered is often extremely limited. She emphasized that in the face of extreme risk exposure, trading platforms have an obligation to take concrete actions to protect user rights, and currently, the account balances of all platform users have not been affected by this incident. For the sake of preventing secondary security risks, management has refused to disclose the specific name of the third-party service provider involved.

Self-Funded Capital Injection, Protection Fund Resets Over $300 Million

Before the incident, the net value of the protection fund established by Bitget had exceeded $464 million. Bloomberg, analyzing public wallet address data, pointed out that the fund briefly fell below the $200 million mark after the attack. In the face of a massive funding gap, Bitget chose to directly use its own capital to cover the shortfall.

Gracy Chen noted that the financial losses caused by this incident have been fully absorbed by the platform, and no risks will be passed on to users. Currently, the protection fund has quickly rebounded and is maintained above $300 million. The protection fund, after the capital injection, is completely independent of customer asset reserves and continues to support external public audits through on-chain data.

External Device Vulnerability Becomes a Springboard, Full Withdrawal Services Restarted

A report from cybersecurity firm Mandiant restored the path of this attack: on September 24, hackers illegally gained privileged access to two sets of third-party security devices within Bitget and implanted a web backdoor in one of the devices to establish a remote control channel, subsequently horizontally penetrating into the wallet operation servers in the production environment and deploying malicious code. The report confirmed that the platform's cold wallet remains secure, with no signs of private key leakage, and the overall loss estimate ranges from $351.6 million to $387.5 million.

Additionally, SlowMist's tracing analysis pushed the source of the malicious activity back to August 31, indicating that hackers exploited a zero-day vulnerability in one of the products to infiltrate. In response to speculation about the hacker organization having a specific geopolitical background, Gracy Chen stated that although there were significant overlaps in early technical characteristics, the final determination still needs to wait for more detailed investigation results. On the business recovery front, following the reopening of core asset channels such as Bitcoin, Ethereum, and USDT, the platform's other cryptocurrencies, fiat currencies, and P2P trading services have fully resumed normal operations as of 4 PM Beijing time on October 2.