How Bitget Is Chasing $388 Million in Stolen Funds After a Zero-Day Hack

Gracy Chen (0:00)

By the way, just after this incident, there are still people who are targeting me. They know that this is the period of time that I'm talking to a lot of external partners, looking for help or just for better communication. And there were cases that they pretended to be from another major investment team who approached us and did something. And we almost started a real conversation. But along the way, I did another verification with the person that they tried to pretend and realized, okay, this is again scammers.

Laura Shin (0:41)

That happened after this hack? Like in the last...

Gracy Chen (0:44)

Yeah, this is not a hack. This is a social engineering towards me.

Laura Shin (0:48)

But it happened in the last few days?

Gracy Chen (0:50)

It happened yesterday.

Laura Shin (0:52)

Oh, wow. Hi, everyone. Welcome to Unchained, your know-how resource for all things crypto. I'm your host, Laura Shin. Thanks for joining this live stream. First, we'll take a quick word from the sponsors who make this show possible. This episode is brought to you by OneInch Aqua, the shared liquidity layer from OneInch. Back multiple liquidity positions with one wallet balance, and keep your tokens in your wallet until a swap fills. See how it works at oneinch.com/aqua.

Not listening to Bits and Bips yet, it's our weekly crypto and macro market show with Ram Allawalia, Austin Campbell and Chris Berkins. Search Bits and Bips and subscribe.

Today's guest is Gracy Chen, CEO of Bitget. Welcome, Gracy.

Gracy Chen (1:38)

Thank you for having me. Always nice to see you, Laura.

Laura Shin (1:41)

Yeah, nice to see you. Sorry that it's not better circumstances. Bitget was just the victim of a huge hack for a total of $388 million. This bears a number of hallmarks of hacks by DPRK.

Let's go back to the beginning. Tell us about that day. I think you found out in the middle of your night. So first of all, tell us how Bitget figured out that it was being hacked and how you learned about it.

Gracy Chen (2:07)

Sure.

Laura Shin (2:07)

Yeah.

Gracy Chen (2:08)

So beginning at 6:31 PM UTC on September 24, we saw some unauthorized transfers. Actually, 6.31 was the first round of unauthorized withdrawal, and that's very small amount. I think the attacker or the hackers are actually very smart. They just did some testing transfer, 0.48 Ethereum from ETH HotWallet and the 93 TRX from Tron HotWallet. Both were below the risk control threshold and did not trigger a system alert. But at 6.58 UTC that day, the attacker initiated 17, starting from 6.58 actually.

So 6.58 is the first timestamp. But basically, the attackers initiated 17 large transfers across different chains and different assets with a total volume of approximately 361 million, that we were stolen during that time.

I figured, actually, our system figured this out much earlier than I did. So 7 minutes after the first large transfer, our platform's reconciliation system detected a significant discrepancy and the rate system automatically blocked all the user-initiated withdrawal platform-wise. But this didn't really fully stop the bleed because the hackers were very smart that they actually hacked into our internal system using a third-party zero-day vulnerability. So, they exploited this vulnerability to gain access to a critical internal management system. And then as an impersonated identity, they then created some fraudulent withdrawal comments and caused the wallet service to execute those transfers. So the hacker just accessed the wallet-related back end servers and directly inserted fraudulent withdrawal comments into the wallet system. Hence, the wallet system was sent out some transfers. And even if the risk system that reacted, that didn't really stop the bleed at that time. But at the same time, another thing that the attacker did is also erasing traces. And that's why it took longer and it became harder for us to identify the root cause. Basically, the hackers, what they did is, after completing the transfers, the attacker deleted all the traces that the fraudulent withdrawal comments might have left behind in an attempt to conceal the attack and hinder the root cause identification. So due to the lack of direct evidence, we needed to examine a broader range of systems to identify the root cause during this incident.

What for me personally, I just happened to woke up about one hour after their first major transfer. Well, at that team, my, especially my technology and the security team are already in full house, like full steam working on that already. But they also haven't really caught me, but I woke up myself.

That's a coincidence. But I'm sure even if I didn't wake up, my team might have caught me in about 10 minutes' time. So when I woke up, that was my 4 a.m. and I saw some text messages on the working phone and I started to, you know, together with our technology team, see what we can do.