Bitget CEO Gracy Chen says she suspects North Korean attackers exploited a backend system used to process wallet transactions to drain $387M from the platform (@c_grigera / Fortune) (Visit Techmeme dot com for the link and full context!)

Bitget CEO: We're Not Going Anywhere, IPO in About Three Years During an emergency livestream on September 24, roughly three and a half hours after Bitget detected unauthorized transfers involving about $350 million, CEO Gracy Chen @GracyBitget responded to claims that the incident was self-inflicted or an inside job. Chen said staging such a hack would make no sense for a company focused on long-term growth. She said Bitget plans to pursue an IPO within the next few years — ideally in about three years — and that a major security incident would only hurt that goal. While the exact cause of the breach remains under investigation, Chen said the evidence at the time looked more consistent with the Lazarus Group.

Bitget: Withdrawals Set to Resume in Phases Starting September 28, Vulnerability Fixed Bitget said the vulnerability involved in its September 24 security incident has been identified and fixed, with withdrawals set to resume in phases after security checks are completed. The schedule is as follows, all at 08:00 UTC: BTC on September 28, ETH on September 29, USDT on September 30, and other tokens, fiat and P2P services on October 2. Bitget said user account balances remain unaffected and its Protection Fund will cover the financial impact of the incident. Trading and deposits remain operational, while Mandiant and SlowMist continue to assist with the investigation.

Bitget CEO: A Fake Interview Cost Me $80,000 On September 24, Bitget CEO Gracy Chen @GracyBitget shared her experience of being targeted by the Lazarus Group. The attackers first compromised the official Twitter account of a major crypto media outlet, then impersonated a journalist to contact her and communicated with her assistant and PR team via Telegram, gradually building credibility. She said the attackers ultimately carried out the attack through a Zoom “interview,” highlighting how social engineering and identity impersonation continue to pose threats to the crypto industry.

Bitget Raises Confirmed Incident Amount to $387.5M, Withdrawal Resumption Plan Due by Sept. 26 Bitget CEO Gracy Chen said in a post that the security incident has been contained and that no further unauthorized asset transfers are possible. Bitget will announce its withdrawal resumption plan by 4:00 AM UTC on September 26. Chen said Bitget has confirmed that approximately $387.5 million in assets were transferred to attacker-controlled addresses, up from the initial estimate of $351.6 million. The higher figure reflects additional Zcash and TRON assets identified during tracing and does not represent new theft. Bitget has also launched a recovery bounty program offering 5% of successfully frozen or recovered funds to eligible participants who directly contribute to those efforts.

Bitget says suspected North Korean hackers stole $351.6 million after compromising a backend wallet system. The attackers spoofed transaction data and triggered Bitget’s authorization process to move funds. Withdrawals are temporarily suspended while the breach is investigated. What Bitget says happened:

Bitget CEO: If Bybit Can Withstand a $1.5B Loss, We Can Withstand a $300M+ Loss On September 24, roughly $350 million was stolen from Bitget. CEO Gracy Chen @GracyBitget said the exchange could absorb the loss and handle a potential bank run when withdrawals resume. She said Bitget's retail trading volume is comparable to Bybit's, arguing that if Bybit could absorb a $1.5 billion loss, Bitget could absorb a $300 million-plus loss. Some public chains have frozen stolen funds, and recovery efforts are underway, though Chen does not expect a full recovery.

Bitget CEO: After FTX, I Don’t Think Major Exchanges Would Comingle User Funds On September 24, Bitget CEO Gracy Chen @GracyBitget said the collapse of FTX was a hard lesson for the entire industry, and that she does not believe major exchanges today would intentionally comingle customer funds. The exchange has a publicly verifiable protection fund of about $460 million, as well as more than $1 billion in Bitget-owned assets, separate from customer funds. She said user assets are backed 1:1 and can be checked through proof-of-reserves and Merkle Tree data.