Bitget CEO Gracy Chen Breaks Down $388M Hack

**Episode 42 of The Starting Block, hosted by The Block's Gareth Jenkinson, was broadcasted live with Bitget CEO Gracy Chen.** Bitget CEO Gracy Chen joins Gareth Jenkinson on The Starting Block to discuss the $388 million hack of Bitget's hot and warm wallets, how attackers exploited a third-party zero-day vulnerability to bypass risk controls, and how the exchange is using its protection fund to cover all user losses. The attack began at 6:31 PM UTC on September 24, 2026, with two small test transactions of 0.84 ETH and 93 TRX that fell below alert thresholds. About 30 minutes later, the attacker initiated 17 large transfers across Ethereum, XRP, ZEC, BSC, Base, Arbitrum, Optimism, and Avalanche, draining approximately 361 million USDT equivalent before Bitget's reconciliation system detected the discrepancy at 7:05 PM and automatically blocked user-initiated withdrawals. The attack unfolded in three steps: exploiting a zero-day vulnerability in a third-party security product to obtain high-level internal credentials; using those credentials to insert fraudulent withdrawal commands directly into the wallet backend, bypassing risk controls entirely; and then deleting all traces of those commands to slow forensic investigation. Private keys were not compromised and cold wallets were unaffected. Mandiant and SlowMist have been engaged as independent investigators, and Bitget published attacker wallet addresses and on-chain tracing data on day one. Chen said a formal incident report will address the attacker's identity, and declined to name a suspect before it is published, though she said her earlier suspicion has not changed. Chen addressed her public appeal to ThorChain to block the stolen funds, saying the protocol responded that, like Bitcoin and Ethereum, it could not intervene. She expressed frustration with that answer while acknowledging her respect for decentralization, and called out ThorChain as a repeated route for laundering stolen funds, including in Bybit's case. She gave shoutouts to Tether and Circle for quickly freezing a portion of the stolen assets, to Mandiant and SlowMist for their investigative work, to volunteer white-hat group SEAL 911 for alerting her team within 90 minutes of the attack, and to peer exchanges including Binance and OKX for public and private support. On the financial side, Chen confirmed that all user balances are fully protected and will be covered by Bitget's user protection fund, established in 2022 and valued at approximately 465 million USDT equivalent on the day of the incident. The fund will be replenished to at least 300 million within a week using corporate reserves, which a Bitget audit as of August 31 showed totalling more than 1.4 billion. Chen said the 388 million loss falls entirely within that buffer and does not threaten day-to-day operations. In the immediate term, the team is focused on processing withdrawals chain by chain, with Bitcoin withdrawals opening smoothly on Monday and Ethereum withdrawals scheduled for Tuesday, and on working with law enforcement, financial intelligence units across multiple jurisdictions, and blockchain foundations to trace and, where possible, recover stolen assets. **About the guest** Gracy Chen is the CEO of Bitget, a major cryptocurrency exchange and Web3 company that ranks among the top platforms for derivatives trading by volume. A passionate advocate for diversity in the Web3 space, Chen is a delegate at the UN Women CSW conference. Under her leadership, Bitget launched the Blockchain4Her initiative, committing $10 million to promote gender diversity and inclusivity in the blockchain industry. She holds a Bachelor's Degree from the National University of Singapore (NUS) and an MBA from the Massachusetts Institute of Technology (MIT). **Key topics** \- Attacker exploited a third-party zero-day to steal $388M from hot and warm wallets. \- All user balances fully protected by Bitget's $465M user protection fund. \- Protection fund to be replenished above $300M within one week. \- Attacker's identity to be addressed in a formal incident report. \- ThorChain declined to block stolen funds, citing permissionless design. **Notable quotes** "Serious doesn't mean existential. We do have the reserve, we do have the team and the capability to go through this." – Gracy Chen **OUTLINE** 00:00 - Introduction 01:07 - Withdrawals Resume 02:31 - The Hack: Full Recap 05:57 - Attack Timeline & Steps 11:12 - North Korea Link? 13:07 - ThorChain & Laundering 17:00 - Industry Support & Shoutouts 21:25 - Law Enforcement & Regulators 24:47 - Protection Fund & Replenishment 28:11 - Solvency & Operations 29:11 - The Road Ahead **Guest links:** Gracy Chen - https://x.com/GracyBitget Bitget - https://x.com/bitget Host links: Gareth Jenkinson - https://x.com/gazza\_jenks The Block - https://x.com/TheBlockCo \--------------------------------------------------------------------------------- Subscribe to The Block's Newsletters! 🚨 Breaking News 👨‍🔬 Expert Analysis 📈 Market Insights Subscribe now 👉 https://www.theblock.co/newsletters \-------------------------------------------------------------------------------- Hiring in crypto? 🧠 Find top talent fast with Campus, powered by The Block! ✅ Challenge candidates with our Crypto Assessment Test ⚡ Hire faster, build stronger teams Start your free trial today 👉 https://theblock.co/campus - (00:08) - Introduction - (00:38) - Welcoming Gracy Chen - (01:07) - Withdrawals Resume - (02:31) - The Hack: Full Recap - (05:57) - Attack Timeline & Steps - (11:12) - North Korea Link? - (13:07) - ThorChain & Laundering - (17:00) - Industry Support & Shoutouts - (21:25) - Law Enforcement & Regulators - (24:47) - Protection Fund & Replenishment - (28:11) - Solvency & Operations - (29:11) - The Road Ahead