Bitget covers $388 million hack loss, points to flaw in third-party security product

Bitget absorbed the full financial impact of a hack that exploited a third-party security product, CEO Gracie Chen said, replenishing its user protection fund and tightening checks on outside vendors.

The exchange said users suffered no losses after attackers transferred about $388 million to addresses under their control. Company capital was used to restore the protection fund after it covered the missing assets.

In an October 24 interview with The Wolf of All Streets, Chen said Bitget decided within the first few hours of the incident to make users whole and bear the financial impact itself.

Chen said the attack began with a previously unknown vulnerability in a third-party security product. Attackers obtained privileged internal credentials and used them to submit fraudulent withdrawals. She said private keys and cold wallets were not compromised, while the involvement of several blockchains and cryptocurrencies complicated the investigation and replenishment of funds.

Automated systems detected large unauthorized transfers and blocked withdrawals, Chen said. Technology, security and product teams handled the initial response, and she became aware of the incident about an hour after the first suspicious withdrawal. She began a livestream roughly three hours after the attack to share confirmed information, providing further details as they emerged.

Chen acknowledged that the third-party vulnerability did not absolve Bitget of responsibility for its own infrastructure: attackers used the flaw to exploit the exchange's systems. She said internal teams and independent investigators considered it an external attack rather than an insider operation, distinguishing it from the misuse and commingling of customer funds at FTX.

Bitget used its user protection fund, established with company capital in 2022, to cover losses in hot and warm wallets, Chen said. Within a week, the exchange injected company capital to restore the fund to more than $300 million. She confirmed that users had lost no money.

The exchange also published an additional proof-of-reserves disclosure after the incident, alongside its regular disclosures. Chen said users could check through Merkle-tree verification that their funds were included. She recalled that the reserve ratio at the time was approximately 131%.

Bitget strengthened assessments of all third-party products, including those unrelated to the incident, and added deployment safeguards and monitoring for abnormal activity, Chen said. Vendors with privileged access must be treated as part of the exchange's security, she argued. She said an exchange with a broad business could not build every function internally, and doing so would not necessarily produce better results.

Chen said there had been no formal attribution of the attack to Lazarus. Although she considered the attackers' use of virtual private networks and laundering methods similar to the group's behavior, independent security firms had not formally identified the perpetrators either. She said attackers increasingly targeted credentials, business processes and trusted tools alongside private keys, and that Bitget remained responsible for building stronger defenses.