Attackers stole approximately $387.5 million from Bitget on September 24 by manipulating its internal withdrawal process. According to Chainalysis, the attack was carried out by North Korean hackers.
So, is Bitget now safe to use? What if the next hack is bigger? And what security measures are the exchange taking? BeInCrypto sat down with the exchange’s CEO, Gracy Chen, to answer these questions.
Latest Updates on the Bitget Hack
As of October 6, the exchange has reopened withdrawals, while investigators continue tracing the stolen funds:
- Withdrawals: Bitget says its phased reopening finished on October 2.
- Frozen funds: Its tracker lists approximately $1.07 million frozen, about 0.28% of the loss. The amount actually returned remains undisclosed.
- Attribution: Chainalysis now attributes the theft to North Korean actors.
- Investigation: The affected third-party security vendors remain unnamed publicly.
In an exclusive BeInCrypto interview recorded before withdrawals fully resumed, CEO Gracy Chen defended Bitget’s financial position. She also acknowledged gaps in its understanding of the attack.
If another hack exceeded the protection fund, could Bitget cover it?
Chen said Bitget had replenished its protection fund above $300 million after using bitcoin from it to meet withdrawals. She considered that threshold sufficient for now, despite the latest theft exceeding it.
She said the company also held more than $1 billion in capital outside the fund.
“I can’t tell you the exact number, but it’s for sure more than one billion.”
Asked about another loss of several hundred million dollars, she said Bitget could absorb it. The interview did not establish how much of that capital was immediately available.
What has the hack cost Bitget in customers and business?
Chen described the impact on daily operations and profitability as limited.
A couple of institutional clients withdrew large sums when Bitcoin withdrawals reopened, she said, but customers had since begun returning.
“Just within the last few days, many of them came back already.”
An hour after Ethereum withdrawals reopened, inflows exceeded outflows, according to Chen. She also described strong inflows when USDT withdrawals resumed.
She provided no figures showing the scale of those deposits or how much withdrawn capital had returned.
How did attackers learn enough about Bitget to build a dedicated withdrawal tool?
Chen said a preliminary internal investigation found no insider involvement. But she could not explain how the attackers acquired their knowledge of Bitget’s systems.
“I actually don’t know. I wish I can ask them and get an answer there.”
She said the investigation remained ongoing and could take longer than Bybit’s because the Bitget incident involved a more complicated set of systems.
Her response leaves a central question open: how much access did the attackers have before the theft?
Chen said Bitget had conducted an internal investigation and found no evidence of insider involvement at that stage.
“The preliminary investigation so far is telling us there’s no internal sort of involvement.”
What has actually changed to prevent another attack?
Chen described isolating affected systems and resetting internal credentials. She said Bitget had tightened access to sensitive systems and introduced additional approvals for withdrawals.
The exchange was also strengthening checks on outside security products. Chen described the entry point as a previously unknown vulnerability in a third-party product, whose affected functionality had been disabled.
She acknowledged that alerts needed to be interpreted correctly and that monitoring should respond faster.
“No system, no security infrastructure is perfect or impenetrable.”
Should services such as THORChain do more to stop stolen money moving?
Chen rejected the suggestion that THORChain was chiefly responsible for exchange hacks. She said protocols had different technical capabilities and respected their permissionless design.
But she wanted operators to explain what intervention was possible. She pointed to NEAR Intents as an example of action taken where the infrastructure allowed it.
“I’m not blaming THORChain for sure.”
Her position was that exchanges should work with protocols to make laundering harder, while acknowledging responsibility for their own security.
Could exchanges form an alliance against these attacks?
Chen said Bitget had discussed an alliance involving exchanges and major protocols. Those talks were preliminary.
She acknowledged the difficulty of aligning participants’ interests. Sharing useful intelligence would also require companies to disclose more about their internal security.
“You want to share enough information, but not too much information.”
The interview shows how much the response depends on an exchange’s ability to cover losses while investigators pursue the money. It also leaves questions about prevention.
In analysis published after the interview, Certora estimated that roughly $238 million left after Bitget’s initial withdrawal block. That finding puts the next test of Chen’s assurances in focus: whether the new controls can stop forged internal transfers once an alarm sounds.
