Bitget Freezes About $1.1 Million of $388 Million Hack, CEO Says Large Recovery Unlikely
Bitget has frozen about $1.1 million of the nearly $388 million stolen in a cyberattack last week, CEO Gracy Chen told CNBC, adding she does not expect a large recovery. User balances were unaffected, and the exchange restored its protection fund using its own capital.
Speaking on CNBC's "Squawk Box Europe" on Wednesday, Chen said exchanges have a responsibility to show how they protect users, "particularly when something goes wrong." Bitget said user account balances were unaffected.
The exchange valued its protection fund at more than $464 million before the theft. According to Bloomberg's calculation of the fund's disclosed wallet addresses, the fund was drawn down to below $200 million after the hack before being restored to more than $300 million. Chen said the replenished fund remained publicly verifiable on-chain and was separate from the reserves backing customer balances. Bitget's latest Proof of Reserves, based on a Sept. 29 snapshot, showed a self-reported overall reserve ratio of 131%, with all 19 covered assets backed above 100%.
"We restored the Fund using Bitget's own capital," Chen said. "The financial impact is being absorbed by Bitget rather than passed on to our users."
Investigation reports released Sept. 30 by Mandiant, part of Google Cloud, and blockchain security firm SlowMist found that the attackers compromised two third-party security products before gaining access to Bitget's production wallet systems. SlowMist traced the earliest malicious activity in available logs to Aug. 31, when a previously unknown, or zero-day, vulnerability was exploited in one of the products.
Mandiant reported that the attackers were then able to obtain privileged internal access and bypass the normal customer-facing withdrawal process without stealing private keys. "The method, I would say, is quite sophisticated," Chen said on "Squawk Box Europe," adding that the attackers deleted traces after transfers to hinder the investigation. Neither report identified the affected security products. When asked, Chen declined to disclose further vendor or product details, citing the potential to introduce additional security risks by releasing information beyond the published findings.
The reports did not attribute the attacks to North Korea. Chen had previously said preliminary technical indicators were highly consistent with known North Korean hacking groups. "We will have to wait further for further details on this," she told CNBC.
Withdrawals for bitcoin, ether and USDT have resumed. Bitget has scheduled withdrawals for its remaining cryptocurrencies, along with fiat and peer-to-peer services, to resume on Friday.
Editor's Summary
Bitget has frozen about $1.1 million of the nearly $388 million stolen in last week's cyberattack, and CEO Gracy Chen told CNBC she does not expect a large recovery. The exchange said user balances were unaffected and restored its protection fund with its own capital. Investigators found that attackers compromised two third-party security products before reaching Bitget's production wallet systems, and the reports did not attribute the attack to North Korea.