Bitget experienced a $387.5 million theft on September 24 when attackers manipulated its internal withdrawal process. Chainalysis attributed the attack to North Korean hackers.
The exchange reopened withdrawals on October 2 and had resumed full operations by October 6. According to Bitget's tracker, approximately $1.07 million in stolen funds have been frozen, representing 0.28% of the total loss. The amount actually returned to the exchange remains undisclosed.
Financial Resilience Claims
In an exclusive interview, CEO Gracy Chen defended Bitget's financial position, stating the company replenished its protection fund above $300 million after using bitcoin from it to cover withdrawals following the attack. Chen said Bitget holds more than $1 billion in capital outside the protection fund, though she did not specify how much is immediately available.
When asked whether Bitget could absorb another loss of several hundred million dollars, Chen said the company could manage it. She described the impact on daily operations and profitability as limited, noting that institutional clients who withdrew funds when Bitcoin withdrawals reopened have begun returning. Chen reported strong inflows when Ethereum and USDT withdrawals resumed, though she provided no figures on deposit volumes or the scale of returned capital.
Security Measures and Unanswered Questions
Bitget isolated affected systems, reset internal credentials, and tightened access to sensitive systems following the attack. The exchange introduced additional approvals for withdrawals and strengthened checks on outside security products.
Chen said a preliminary internal investigation found no evidence of insider involvement. However, she acknowledged not understanding how attackers acquired sufficient knowledge of Bitget's systems to build a withdrawal tool. She attributed the entry point to a previously unknown vulnerability in a third-party security product, whose affected functionality was disabled.
Chen acknowledged that security monitoring needed faster response times and that alerts required correct interpretation. She noted that no security infrastructure is entirely impenetrable.
Industry Response
Chen rejected suggestions that protocols like THORChain bore primary responsibility for enabling stolen funds to move. She noted that protocols have different technical capabilities and respect permissionless design, while pointing to NEAR Intents as an example of infrastructure action taken where possible.
Chen said Bitget had held preliminary discussions about forming an alliance with other exchanges and major protocols to combat attacks. She acknowledged the difficulty of aligning participants' interests and noted that sharing useful security intelligence would require companies to disclose more about their internal operations.
Following the interview, Certora estimated that roughly $238 million left after Bitget's initial withdrawal block, placing focus on whether new controls can prevent forged internal transfers when alarms sound.
