Bitget CEO Gracy Chen says she suspects North Korean attackers exploited a backend system used to process wallet transactions to drain $387M from the platform
Another major hack has rattled the cryptocurrency world. On Thursday night, crypto exchange Bitget suffered a security breach …
FortuneCamila Grigera Naón
Context & Ripple Effects
On September 24, Bitgethalted withdrawals after unauthorized transfers from hot and warm wallets affecting roughly $351.6 million, while Chen said customer funds were safe. The reported $387 million figure and focus on the wallet-transaction backend sharpen the incident from an asset-transfer disruption into an operational-security failure.
Chen’s attribution to North Korean attackers is a suspicion, not a confirmed finding. In public reactions, Bitget asked THORChain to refuse service to flagged addresses, while Circle and Tether were credited by Chen with freezing a linked address—exposing different intervention powers across crypto infrastructure.
First-order effects
Bitget must contain and remediate the wallet-transaction backend implicated in the breach while restoring confidence among customers affected by the withdrawal interruption.
The alleged attacker attribution puts Bitget’s recovery effort around address tracing and fund freezing, rather than a confirmed identification of the perpetrators.
Second-order effects
THORChain faces pressure from Bitget to block identified addresses, but its public response frames the protocol as permissionless, limiting the exchange’s ability to rely on it for enforcement.
Stablecoin issuers such as Circle and Tether become consequential recovery counterparties when they can freeze linked addresses, giving centralized issuers a role that permissionless protocols may reject.
Third-order effects
The episode underscores a split crypto-security model: centralized exchanges and stablecoin issuers can intervene after an exploit, while decentralized routing layers may not offer equivalent controls.
If major exchange breaches continue to route stolen assets through permissionless infrastructure, the legitimacy debate will increasingly center on whether anti-theft response is compatible with protocol neutrality.
The trend: Crypto market infrastructure is being tested by the growing mismatch between centralized recovery controls and permissionless systems’ resistance to transaction-level intervention.
We are devasted to hear about the recent exploit and can imagine how difficult this must be for everyone involved. THORChain is decentralized and permissionless like Bitcoin, Ethereum, and BNB Chain. What responsibility should Bitcoin, Ethereum, and BNB Chain bear when handling k…
THORChain and Stolen Funds: The Industry Needs Answers After the $1.46B @Bybit_Official hack last year, nearly $1.2B in stolen funds was reportedly traced through @THORChain as the attackers moved assets across chains. Today, following another major security incident at @Bitget ,…
Shame on you @GracyBitget! I get that it's a very stressful and unfortunate time, buy this is an incredibly unfair thing to ask. NO ONE asks Bitcoin or Ethereum to reverse transactions, yet both have in the past rolled back the chain, Ethereum explicitly to reverse an exploit. @T…
Our attacker addresses are publicly listed and actively tracked. We are formally asking @THORChain to refuse service to these addresses. Decentralization is a design principle, not a shield for facilitating known stolen funds. The industry is watching.
Thank you to Circle and Tether for moving quickly. Every address frozen matters. To the broader community: Bitget's Recovery Bounty Program is live — 5% for freezing attacker funds, 5% for recovery. Every exchange, security researcher, and onchain investigator can make a differen…
We stand with @bitget and its users after the recent incident. Our security team has been working closely with their side since it was detected, sharing intelligence, tracing funds, and supporting recovery. In moments like this, the industry unites against the attackers. The work…
Here is what we can confirm at this stage: On the attack: Our security team has made initial progress in tracing the source. The attacker compromised a critical backend system within our wallet infrastructure, used it to spoof transaction data, and triggered our authorization pro…
Earlier 7 hours ago, I hosted a live stream with everyone that lasted over three hours. Here's a summary of the points I covered in the live: ① Bitget security incident update — 1 hours in. We're sharing specific facts, not just reassurances. ② Affected assets include ETH, XRP (t…
Bitget will begin resuming withdrawals in orderly phases following the security incident identified on September 24. The vulnerability involved in the incident has been identified and remediated. Bitget's security and technical teams have since been conducting additional validati…
Within 24 hours of the September 24 (UTC) incident: here is our further update as promised. Our investigation with Mandiant and SlowMist is ongoing — thorough forensic analysis takes more than 24 hours, and further findings will be shared as they become available. Three key updat…
Bitget will begin resuming withdrawals in orderly phases following the security incident on Sep 24. Thank you all for your patience. Please understand that due to the different nature of this incident (which involves multiple blockchains and multiple cryptocurrencies), we are tak…