Sep 30, 2026 · 1h 6m

Bitget confronts the limits of crypto’s emergency response

How Bitget Is Chasing $388 Million in Stolen Funds After a Zero-Day Hack

The hack tests whether exchanges, blockchains, stablecoin issuers, and permissionless protocols can coordinate when stolen funds cross jurisdictions and networks.

3 key takeaways

1A compromised third-party security product enabled roughly $388 million in fraudulent withdrawals across multiple blockchains.
2Bitget moved assets to cold storage, used its protection fund, and offered a 10% bounty while recovery remained limited.
3The response exposed a central crypto tension: permissionless networks resist intervention even when coordinated action could disrupt laundering.

Don't miss

The discussion of ThorChain captures the episode’s central dilemma: whether a permissionless protocol should intervene against suspected hackers.

The brief

Bitget CEO Gracy Chen reconstructs a September 24 zero-day attack that began with small test transfers and escalated into roughly $388 million in fraudulent withdrawals.

The breach exploited a previously unknown vulnerability in a general-purpose security product, leaving Bitget to investigate compromised keys, contain the incident, and move funds into cold storage.

Recovery depended on cooperation from Tether, Circle, researchers, security firms, and infrastructure such as Near Intents, while other networks faced pressure to block linked addresses.

The sharpest tension emerged around ThorChain: intervention might hinder laundering, but governance and node autonomy make permissionless systems reluctant to act as gatekeepers.

Chen describes a 10% recovery bounty, Bitget’s $464 million protection fund, tighter third-party diligence, and continuing impersonation attempts targeting crypto executives.

What was said on this episode

13 statements · 8 positive · 5 negative

Gracy Chenon Tether and CirclePositive20:01
Tether and Circle helped freeze some stolen stablecoins.
“Tether circle these two stable coin issuers at the uh first two batches of um organizations who help us throw some stable coin on on the uh that that's from our stolen funds”
Listen at 20:01
Gracy Chenon NEAR IntentsPositive20:17
NEAR Intents helped freeze roughly $500,000 of cryptocurrency.
“yesterday near intend also help us froze another uh i think it was 550 500k ish sort of different crypto that went through the NEAR protocol”
Listen at 20:17
Gracy Chenon Stolen funds recoveryNegative20:57
Recovering stolen funds is harder than freezing them and requires legal procedures.
“Phrasing is slightly easier. Our recovery, we need to go through a lot more, especially legal procedure, which we are doing our best.”
Listen at 20:57
Gracy Chenon Bitget stolen funds recoveryNegative21:29
Bitget is unlikely to recover more than 3.5% of the stolen funds.
“I just hope that this time we can do better than 3.5%. But I don't have much hope, honestly.”
Listen at 21:29
Gracy Chenon CirclePositive22:51
Circle acted quickly in response to the incident.
“Circo actually moved quite fast in this situation.”
Listen at 22:51
Gracy Chenon Bitget stolen-funds tracking dashboardPositive23:09
Bitget will maintain a dashboard tracking stolen-fund addresses for a long time.
“We published a dashboard that follows all the stolen funds addresses, and it's still alive. We'll keep it alive a long time.”
Listen at 23:09
Gracy Chenon Bitget third-party verificationPositive48:28
Bitget should perform more third-party checks after the incident.
“Do a lot of checks on the third party. Yeah, this is definitely one thing that we didn't do enough. and we are going to change that.”
Listen at 48:28
Gracy Chenon Social engineering in crypto attacksNegative48:44
Hackers frequently use social engineering in crypto attacks.
“hackers are using a lot of social engineering”
Listen at 48:44
Gracy Chenon Crypto security practicesPositive50:17
Crypto users should follow basic security practices carefully.
“please do the basic things very well”
Listen at 50:17
Gracy Chenon Crypto custody securityPositive50:31
Crypto custodians should build complex security infrastructure and check every exploitation possibility.
“you do have a much more complicated security infrastructure that you should build and you do want to check on every single possibility that you can be exploited”
Listen at 50:31
Gracy Chenon North Korean cyberattacksNegative52:37
Many North Korean-targeting incidents likely begin with social engineering.
“the general ideas behind a lot of North Korean incident target is that, again, it started off very likely as a social engineer”
Listen at 52:37
Gracy Chenon Unfamiliar livestream interview softwareNegative54:13
Unfamiliar livestream software for interviews should be treated as highly suspicious.
“if someone who asks you to do an interview on a strange live stream platform you know if it's not the the google meet or the zoom that you keep using they give you another software i think this is highly suspicious”
Listen at 54:13
Gracy Chenon Social-engineering verificationPositive54:54
People should double-check unusual or even familiar requests before acting.
“you just want to be very, very cautious when you see anything that may not be a norm or it may not be, or even if it's a norm, you want to double check”
Listen at 54:54

Statements are attributed to the speaker as said on the episode and reflect their view at the time, not PodLume's. They are not advice.