Unchained - How Bitget Is Chasing $388 Million in Stolen Funds After a Zero-Day Hack

Episode Date: September 30, 2026

Bitget lost $388 million — and days later, CEO Gracy Chen says scammers posing as a major investment team targeted her. ======================================================== Thank you to our sponsor! ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠Visit⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ 1inch.com⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ to swap tokenized securities, crypto and more. Simple. Secure. Self-custodial. Whatever asset you’re buying - swap it at⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ 1inch.com⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ ======================================================== Quick favor: We're deciding what Unchained does next; new shows, stream times, what's worth paying for.⁠⁠ Our listener survey⁠⁠ takes five minutes, it's anonymous, and I read the write-in answers myself. Everyone who takes it can enter a drawing for a free year of Unchained Premium or Bits + Bips Premium. Open through Sunday, October 18. — Laura ======================================================== On September 24, attackers used a zero-day in a third-party security product to slip fraudulent withdrawal commands into Bitget's wallet system, pulling out about $388 million across chains from Ethereum and XRP to Zcash. Bitget CEO Gracy Chen joins Laura Shin to reconstruct the attack, from test transfers that stayed under risk thresholds to her team's call to switch wallets back on mid-attack and sweep hot and warm funds into cold storage. She lays out how the exchange's protection fund covered users and why reopened withdrawals showed an early net inflow. Then comes the industry response. Tether, Circle, and NEAR Intents froze funds, THORChain declined her request, and only $632K is frozen so far. Chen also describes scammers impersonating an investment firm to target her after the hack. Her case that "permissionless doesn't mean neutral" puts a hard question to DeFi. Host: ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠Laura Shin⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠, Host / Unchained Guest: ⁠Gracy Chen - CEO of Bitget Timestamps 🚨 01:50 How attackers used a third-party zero-day to fake withdrawal commands ❄️ 07:15 Why Bitget switched wallets back on mid-attack to sweep funds to cold storage 💧 14:30 1inch Aqua: See how LPs back multiple positions with the same token balance at http://unchainedcrypto.com/go/1inch-sn ⛓️ 15:37 Why the hackers were able to transact even after withdrawals were paused 🧊 19:04 How Tether, Circle, and NEAR Intents froze funds, and why recovery is harder 🕵️ 24:05 ZachXBT's shift on the Bitget hack and his earlier pump-and-dump claims 🛡️ 30:01 NEAR Intents vs. THORChain: does permissionless mean neutral? 💰 41:55 Why Bitget built its protection fund in 2022 and how it covered the loss 🎭 48:17 How scammers posed as an investment team to target Gracy after the hack 📈 01:01:32 A net ETH inflow after withdrawals reopened, and whether the IPO is still on Learn more about your ad choices. Visit megaphone.fm/adchoices

By the way, just after this incident, there are still people who are targeting me. They know that this is the period of time that I'm talking to a lot of external partners, looking for help or just for better communication. And there were cases that they pretended to be from another major investment team who approached us and did something. And we almost started a real conversation. But along the way, I did another verification with the person that they tried to pretend and realize, okay, this is again scammers. That happened after this hack?

This is not a hack. This is a social engineering towards me. But it happened in the last few days. It happened yesterday. Oh, wow. Hi, everyone. Welcome to Unchained. You're no hype resource for all things.

I'm your host, Laura Shin. Thanks for joining this live stream. First, we'll take a quick word from the sponsors who make this show possible. This episode is brought to you by 1 Inch Aqua, the shared liquidity layer from 1 inch. Back multiple liquidity positions with one wallet balance and keep your tokens in your wallet until a swap fills. See how it works at 1inch.com slash aqua. Not listening to Bits and Vips yet, it's our weekly Crypto and Macro Market Show with Rom Alawalia, Austin Campbell and Chris Birkins. Search Bits and Bips and subscribe. Today's guest is Gracie Chen, CEO of BitKet. Welcome, Gracie. Thank you for having me.

Always nice to see you, Laura. Yeah, nice to see you. Sorry that it's not better circumstances. BitKet was just the victim of a huge hack for a total of $388 million. This bears a number of hallmarks of hacks by DPRK. Let's go back to the beginning. Tell us about that day.

you found out in the middle of your night. So first of all, tell us how Beckett figured out that it was being hacked and how you learned about it. Sure. Yeah, so beginning at 631 PM UTC on September 24, we saw some unauthorized transfers. Actually, 631 was the first round of unauthorized withdrawal, and that's very small amount. I think the attacker or the hack. attackers are actually very smart, that they just did some testing transfer, 0.48 Ethereum from an ETH hot wallet, and the 93 TRX from a Tron hot wallet. Both were below the risk control threshold and did not trigger a system alert. But at 658 UTC that day, the attacker initiated starting from 658, actually. So 650 is the first time step.

But basically, attackers initiated 17 large transfers across different chains and different assets with a total volume of approximately $361 million that we were stolen during that time. I figured, actually, our system figured this out much earlier than I did. So seven minutes after the first large transfer, our platform's reconciliation system

detected a significant discrepancy, and the risk system automatically blocked or the user-initiated withdrawal platform-wise. But this didn't really fully stop the bleed because the hackers were very smart that they actually hacked into our internal system using a third-party zero-day vulnerability. So they exploited this vulnerability to gain access to a critical. internal management system. And then as an impersonated identity, they then created some withdrawal, fraudulent withdrawal comments and caused the wallet service to execute those transfers. So the attacker just accessed the wallet-related back-end servers and directly inserted fraudulent

withdrawal comments into the wallet system. Hence, the wallet system, you know, sent out some transfers. and even if the risk system that reacted, that didn't really stop the bleed at that time. But at the same time, another thing that the attacker did is also erasing traces. And that's why it took longer and become harder for us to identify the root cause. Basically, the hackers, what they did is after completing the transfers,

the attacker deleted all the traces that the fraudulent withdrawal comments might have left behind in an attempt to conceal the attack and hinder the root cause identification. So due to the lack of direct evidence, we needed to examine a broader range of systems to identify the root cause during this incident. For me personally, I just happened to woke up about one hour after their first major transfer. while at that team, especially my technology and the security team are already in full house, like full steam working on that already. But they also haven't really caught me, but I woke up myself.

That's a coincidence. But I'm sure even if I didn't wake up, my team might have caught me in about 10 minutes time. So when I woke up, that was my 4 a.m. and I saw some text messages on the working phone, and I started to, you know, together with our technology team, see what we can do. And I also decided to be on a live very quickly because I figured this is the time that the whole community is speculating

because all the things are unchain. People can see. There are also external, like voluntary-based white hat, White Hat hackers like CO-911. I know their founders in CZ-Z-Soon and a couple of other voluntary white-hat hackers. We've already been in a telegroup for many years because we help each other tracking different funds.

There were cases that some fraudulent funds went to bigget and will help them first. So I saw from that group, like the external community, are already discussing and asking us. So I wanted to be very upfront answering questions and facing the community directly. Okay. Yeah. I mean, it's really impressive that you got on that life so quickly.

And it was sort of reminiscent of when Ben Jiao of Bybet also did something similar. I did want to ask, you know, about the fact that they did the test. transactions and and also had covered their tracks. Because I asked Taylor Monaghan what she would ask you. And she basically asked why there were these transactions that spanned over what she thought was about three hours. Is that, is that accurate? Yeah, that's accurate. The first large transaction, as mentioned earlier was 6.58. The last transaction was at 923. So that's less than three hours from the first testing transfer. Okay. And so was it because they had covered their tracks that you weren't able to stop, that one that happened almost three hours later? I think there

are mainly two reasons. The first one is what we discussed earlier, like finding the road. and do the remediation took it, took longer. But we did one specific important thing that we also did in between the two rounds of their attack is that there were actually technical containment measures that my technology and technical and the security team did. But at that time, we cannot rule out the possibility of a private key compromise. So we again switched on certain buttons and allowed the different wallets to make transfer

so that what we did is we collected all the money from the hot and warm wallet back to cold wallets. And that gave the hacker another chance of doing attack. But the amount is much smaller. The total value of the second round of attack is about $30 million. And that's from $8.55 to $9.23 because we stretched on the system again and allowed them to give them another chance. But we needed to do that because there were far more than $30 million on the hot and the one wallet that we needed to rescue.

So there were mainly two rounds. And in between, there is this, you know, important discussion that we needed to make. And there are so many possibilities. So a huge difference between Begettec and ByBetethe is that ByBethech, the route was quite clear, right? It's a safe wallet, front-end issue that touched their code wallet. But our issue is very different. It's hot and the warm wallet, and it seems like it can have a lot of different causes. And that's indeed why it made it much harder to identify the root cause, because it involves a lot of systems and a lot of different public chains.

And then what can you tell us more about the third-party system that was hacked and how that transpired? I can't disclose the third party name nor the exact vulnerability. It is a security product that we used to hopefully make it more secure. But the vulnerability is a zero-day vulnerability. It means it's never discovered before. But the key thing here is I don't want to blame external party. We are taking the full responsibility. And we are going to publish incident reports.

very soon, probably today or tomorrow, but definitely within a week that can give you more details and give the community more details on the, you know, this vulnerability itself. I think in general, we've also want to, you know, we've already notified the vendors about their vulnerability. So there are a lot of things that we're doing together. And this is still an ongoing incident, right? So other than the hack itself, Right now, I think we as a team are looking a lot about, number one, business and operation-wise. How can we wing our users back? How can we get all the business as usual?

And then at the same time, watch and trace all the hackers' activity around the money laundering. And we actually worked together with a lot of different decentralized protocols. I know you guys covered this yesterday. like there were protocols that refused my request of, you know, phrasing certain addresses, not serving the hacker. There are also other DFI protocols that came out and said, oh, we helped you froze your account. And we are not interested in the bounty because we want to recover more.

I think right now I see a lot of different faces, although they are all doing DFI protocols. And as a community or as an industry participants, I really, really appreciate whoever at this stage helping us, you know, avoid, raise some of our stolen funds and then not allowing the hackers to easily launder the money. Okay. And out of curiosity was the third party vendor, one that is familiar with the threat level for crypto companies? Like, was it a security company that, you know, also understands, kind of just that there's a heightened level of security needed for crypto companies, or were they more a general provider? They are slightly more general provider. I would say if you are not a crypto company,

you might have used their service as well. But again, I think this part is easier if we leave it to the incident report to answer more, you know, thorough question rather than me disclosing too much. Okay, well, one last question that I have to ask is whether or not social engineering was involved? I can't answer that either, but I can assure you that if it's Lazarus, they use social engineering a lot, and social engineering is a common threat targeting the whole industry. But for this incident, exactly, I can't answer that question. I'm sorry. Okay. Okay. Because obviously after Drift, that's what's on everybody's mind. And that one was was so chilling. But I totally understand if you want to wait until you have your fully polished

explanation to release. All right. So we're going to go into more details around, you know, which assets were affected and which chains and what happened to the attempt to recover those funds. But first we're going to take a quick word from the sponsors who make this show possible. $540 million. That's how much concentrated liquidity sat idle in a given week in the first half of this year. About 30% of the Defi TVL, if you're wondering. That's according to Dune Research commissioned by 1-inch. But there's a solution.

One-inch Aqua is the new shared liquidity platform. It lets LPs back multiple positions with the same token balance and keep their tokens in their wallet till a swap comes. Why does that help? Because the LPs don't have to split their tokens across positions. They can cover more market conditions and pairs with their full ballots. That means more activity across deeper liquidity. See how it works at 1inch.com slash aqua.

Remember that providing liquidity carries risk and fees aren't guaranteed. If you like this show, there's another one from our network you should be listening to. Bits and Bips is our twice weekly market show. On Mondays, Ram Alawalia, Austin Campbell, and Chris Perkins chat about where crypto and macro collide. It's sharp, it's fast, and it has its own channel. Search bits, plus sign bips, and subscribe. Back to my conversation with Gracie. So, as you mentioned earlier, there were a number of affected chains, Ethereum, XRP, Avalanche, Avalanche, optimism, BSC, base, C-Cache.

and I noticed that Zcash was actually listed a day later maybe or something, and I just wondered why it was not noticed initially? I think there were two public chains, actually, is the Zcash and TIA or Zcash in Trong? There were Zcash in another public chain that we later on discovered. that's also involved or affected in this incident because it's a relatively smaller assets and public chain used at our platform. So that wasn't on the first round of detection. It wasn't really because Zcash is Zcash. I know Zcash as a privacy coin do have very different features than many other cryptocurrencies, but it's mainly because it's a smaller chain.

Okay. Okay. Yeah, I just was curious about that. So I then also wanted to ask. So I'm sure that the exchange has protocols in place for situations like this. You kind of mentioned, you know, earlier the move to transfer a large portion of the funds in the hot wallet and the warm wallet to the cold wallet. So I was curious, like, if you had any other, you know, insight you could give us into what the plan is, because obviously the pause on withdrawals, I think, happened later. And I wondered kind of why that wasn't put in place earlier. The part of the withdrawal actually were automatically switched on at 705.

The power waste set seven minutes later than seven minutes after the first large initial transfer. we've already, like the whole risk system already automatically blocked the user-initiated withdrawal. But the part that you were asking in terms of, like, us naming it as a withdrawal pause is slightly later. Because actually at that time, whether we stop withdraw or not doesn't really make the difference in terms, because the user, the hacker is not doing a normal user withdrawal. If that, hopefully that answers your question. So later on, it's more of just users cannot even do the withdrawal button.

And for us, the withdrawal paused slightly earlier at 705 when the system detected this significant discrepancy. Okay. But then I don't understand how they were able to do the subsequent transactions? Because it's not normal user withdrawal. It's at the back end server sort of withdrawal. Oh, I see. I see. They were just using a totally different mechanism.

Okay. Okay. All right. So let's now talk about your attempt to recover these funds because, obviously, I did see that you reached out to a number of different foundations. across these affected chains. Some of them had frozen the hacker's wallets. And I wondered if you, you know,

because there's a lot of discussion on the timeline about which chains can do what. And so, you know, from your discussions with them, I don't know if you could help illuminate what determines whether or not a foundation can freeze wallets or not. I don't have much information, but I don't have the firsthand like expertise on this.

I do have another team member, actually a few team members, who are more hands-on in terms of understanding the mechanism of this public chain and that public chain. But I want to highlight like so far there are a few organizations who are being very helpful, tether circle. These two stable coin issuers are the first two batches of organizations who help us for some stable, coin on the that's from our stolen funds and then yesterday

Near Intend also helped us froze another I think it was 500K ish sort of different crypto that went through the the Near Protocol

not the direct near protocol but the near intent sort of swap, what a swap I think but basically these three right now are the main sources of organizations that help us for some accounts and some addresses. But I think the recovery is just another story. Recovery is different from phrasing.

Phraising is slightly easier. Recovery, we need to go through a lot more, especially legal procedure, which we are doing our best. But again, I don't think that's a huge source of funds that we are looking at to get back. For example, if you look at ByBids hack, after one year, the ByBids stolen fund of more than $1.4 billion, there were only 3.5% that's frozen.

And then the part that they got to recover, it's much smaller. I just hope that this time we can do better than 3.5%. But I don't have much hope, honestly. Okay, okay. Yeah, I mean, I would imagine, so what happened last time was that with Arbitram, they were actually able to freeze 71 million, but that involved getting the Arbitram Security Council involved. And with Circle and Tether, because they're apps, you know, on these chains rather than chains themselves, it's just a much easier, quicker decision. But I did want to ask about, you know, Circle, because they're apps, you know, on these chains rather than chains themselves, it's just a much easier, quicker decision. But I did want to ask about, you know, Circle, because they were criticized in the past repeatedly, but especially I feel like for the drift hack, for not acting and instead allowing the stolen funds to move freely. And obviously, you know, this time around,

it was a much smaller amount that they were able to help out with. But why do you think that they, or I don't know if you have any insight into why they moved to help at all, because that was sort of new for them? Well, I didn't follow the drift case in terms of U.S. or USCC or Circus action that closely. So I don't know the details in terms of how the drift case is different from hours. All I can tell you is Circle actually moved quite fast in this situation.

I don't know if it's because, you know, they decided to change some protocol rules, or maybe it's because the case that different way published all the information very, very quickly. We publish a dashboard that follows all the stolen funds addresses and it's still alive. We will keep it alive a long time. ByBits, Lazarus, they have a Lazarus Bounty website that they created right after their hack. Right now, if you go to that website, the first page dashboard is still obviously ours. So there are maybe as an industry, we all evolved. But again, I don't have the details on the drift case, so it's hard for me to tell you why this time is different.

Okay, okay. Yeah. Well, yeah, it's definitely noticeably different because we actually did a whole episode on how they did not act at all for $280 million or something like that. So, yeah, I was surprised to see that this time. There's another actor who appears to have changed. changed a stance during this incident. And that's Zach XPT. Earlier this year, he tweeted about, I mean, there were a number of these, but he tweeted

about some pump and dump activity that he saw that he felt originated on BitGad, also on Gate and Finance. He tweeted, Sean Liu is the BitCat big boss who allows these scams to operate behind the scenes while Gracie Chen is only the face of it. The Chinese sex cartel has gone unchallenged for you. years and doesn't care as long as they benefit from the activity. And then he said, I think it's almost time to increase public attacks against BitGET. And later he tweeted about a token, lab token, which he called a market manipulation scheme via spot. And he was saying that he thought 95% of the

supply was held by insiders. And again, during that, he was calling out BitCat because I guess he traced that a number of the insiders had withdrawn almost $500 million from BitGep. So last week after, you know, news of the Bickett hack went out, he initially tweeted, I have no current plans to monitor the Bickett exploit by DPRK. I stopped wasting my time on helping people in the industry who are not supporters of my work, donors, clients, longtime followers, et cetera. So it sort of seemed he was like throwing shade on your exchange. But then on Monday, he tweeted that he saw Chinese illicit actors trying to launder funds for DPRK

from the Beckett Hoc asking for help in Discord. He identified five aliases that were being used. He revealed the transactions that were tied to those aliases. So I was curious, like, what happened in between the initial announcement that he wasn't going to work on this? And then, you know, the time when he actually noted where some of the funds had gone. I don't know. You should ask that question. We did talk to him and among many other on-chain researchers, voluntary,

like those white hat hackers that I told you about in some formal companies such as Slow Mendes and Mendiant that we formally engage and they are helping us independently research and come up with incident report. So our team, actually, I didn't talk to Zach directly, but we do have a dedicated team that consists of technology team, blockchain expert from our team, listing team who know a lot of people in this industry, that they are working together to talk to on-chain researchers. I don't think we formally sort of like paid Zach a retention fee to start investigation, nothing like that. So maybe he is just, you know, looking at the so-called Chinese elite-state actors

laundering money and that he find it hilarious. I actually saw that post and when I saw the Discord conversations, I also find it quite hilarious. Like you saw someone said, you know, you chose the wrong job pal and I made a, made a, made a, found comments on Zach's Twitter post saying, yes, indeed, they chose the wrong job. But other than that, we're not like formally engaging Zach, but I do appreciate him and anyone right now in this industry who are who cares and who are working together to make him very hard for the hackers to launder our stolen funds. And do you have response to his allegations from a few months ago where he felt like these pump and dump schemes were either originating on your exchange,

but then also, you know, some of the teams were cashing out from your exchange? Well, all these cryptocurrencies, if you look at many of the name that he specified, they are all listed on many exchanges. They are typically also listed on on Binance and, you know, gate, Beget, by a bit, okay, like all the top exchanges sort of have listed this token. So I can't really respond to him saying, you know, pump and dumb only happened at Begett because it's available on many exchanges. And then maybe we can discuss further in another chance after I get a chance to look at the specific pump and dump activity that he is referring to. But right now, I don't have a response on that.

Okay. And from his identification of those aliases and the transactions, did that enable you to either get some of the funds frozen or even recovered? For this one, particularly, I don't know, because this post that he tweeted was only yesterday. and I have a team who are covering this, which they haven't told me specifically about whether this particular information is helpful or not. I know the near-in-10 thing because they updated me that it's quite useful and they are approaching,

like my team is approaching near intent. They have a teacher group set up already. They are discussing the exact procedure we should take from our legal end in order to, you know, hopefully recover those funds. So those are, there are something that I'm updated, hence I know. For the Zach part, I am not updated, so I don't know yet. Okay, so yeah, well, actually, why don't we talk more about near intent? So this is going to be a setup for kind of a contrast that we're seeing from different teams in the industry to this.

pack. So go ahead and talk about what it is that near intense did that was so helpful for you. Yeah, well, near intense, first of all, I also just learned like shelled system through this article that the near intent CEO just wrote. Alex, he talked about how near intense as like they build this shield thing that's basically a raised intelligence layer protecting near intent and also protecting near in a way that basically it automatically detects any deviations and flows and collect a lot of inputs from KYT, your transaction, intelligent providers, independent researchers, and then based on all these signals that the protocol can decide whether they want to, you know, allow a particular transaction to happen or not a lot or not.

So there stands that that is permissionist doesn't mean neutral, that they should basically refuse to help londer stolen assets is a key point or a key stance that they are making, which in my opinion is, of course, I really thank them for that. Because as I pointed out earlier to another DFI protocol that we publish all this data on the dashboard, those are obviously laundering flows and stolen funds, and we hope the protocols can react to them. But whether they can or not is a technical problem. It may also be a governance problem. And each individual DFI protocol works very differently. That is totally like a new world that I'm not that familiar with.

I know some high-level concepts. But for the exact protocols, we just want to appreciate anyone that in this case say something like, okay, perniciousness doesn't mean neutral because I do think that should be the case. if it's so easy for those hackers to launder their money, obviously there will be more hackers and there will be more hacks towards the major players in this industry or even small projects, right? Along these few years that I'm in this industry,

I've seen a lot of hacks towards big ones, towards smaller ones. But in total, hackers are one of the largest enemies of this industry, and we should all stand together to fight. them rather than allowing them easily laundered stolen funds. Yeah, so now let's also talk about Thorchain as a contrast, and then we can kind of tie this together, because you publicly ask Thorchain not to service the addresses that were associated with the hack because there was laundering that was flowing through there. And I have been seeing some conflicting takes around how much control they have to block these

transactions. There's a lot of Thorchand stands. Thor chain stands who are saying that they, you know, it's permissionless, blah, blah, blah. But as far as I understand, I think they have an admin key. So, you know, what's your, like, when you made the request, what was your understanding about their capabilities to, you know, potentially block the laundering of the stolen funds? My, okay, so at that time, I don't think I know exactly how their governance work, neither do I know it now. The key thing is it's quite clear that, again, those are public information that we listed and keep track. And hence, I just decided to formally ask them to refuse services. to the addresses.

Of course, by asking them, it could be their team members if they are very much like there's a core foundation, or it could be the nodes and the swaps on that public chain or so. Of course, later on, I also did more research. I realized, yes, there were cases that they shut down the system because of some other hacks, especially some hacks that they themselves were, victim. But in general, it's not something I want to, you know, just targeting Thorne Chain by saying, oh, you are, you should, you should change your protocol from permissionless to be something else.

I think what near intent did was quite interesting that as a solution, although the publishing still is a permissionless, but you can build a layer on that to do more KYT, to, to avoid the hackers found, something like that. Yes, I did see a lot of different, even there are some major industry leaders who are even our competitors, right? Like they came out and accused thronging for being not standardized their standard.

Like when it's them being the victim, okay, they can shut down the system. And when it's not them, it's us. they just refused it. I saw the Thorn Chain's official tweet to refuse my request. But over the weekend, I still had a lot of things to do, like more than 100 things on my list. So speaking to Thorn Chain wasn't a major one,

but I did later on, reached out to them through third party privately, and I wanted to, you know, hopefully schedule a meeting with them to understand how, their protocols work and what we can potentially do together. I also made this as a shout out or call out yesterday at another podcast said, you know, Throne Chan, I want to talk to you. And let's sit down and discuss. But other than that, I don't have a lead now with Throne Chang. And there

are still a lot of funds that we can chase after and my teams are working around. But have you felt like when you had the private conversation, did you find that they were amenable to helping you in any way? No, I haven't. I haven't had a private conversation. I reached out to them through some third party people, but nobody gave me a firm lead to their core developer yet. I see. Okay. Well, so now that you're in this situation and you're seeing this whole discussion kind of around like what different actors in the industry should do in an incident like that. I mean, you started to expound on that earlier, but I don't know if you have further thoughts on, you know, what types of organizations should move to act, like when the principles of decentralization

and permissionlessness should, you know, be prioritized. Like, how do you think about this now that you are in this situation? Well, last year when I was looking at Bibit's situation, I was quite surprised that as an industry, we can't stop the bad behaviors or the hackers laundered their money. Now I'm experiencing it, but still there are some parts of it

that I don't get why. So back to your question, I would first call out to public chains and protocols that they should not, hopefully, that they do not need to choose between being open and excluding hackers. And we, for us, all we can do is, you know, call out. And then for those who can phrase some of our frozen accounts, that we want to, you know, follow the appropriate legal and recovery procedure

so that like the near intent pointed out they needed us to do that so that hopefully they can recover the funds for us. So that's exactly what we're doing. But more collaborations. I know there were a few team members of mine who are on this specific project of chasing after the losing fund. They have been engaged in many groups. They gave me like a daily update-ish.

But so far, we are not seeing a lot of progress. If you look at Biggets, actually, let's take a lot of, look now. We have a dashboard of tracing all these funds, which is called trace. BG blockchain.xyZ slash V2 Explorer. But if we look at the frozen amount right now, out of the total stolen amount of 388 million, there are only $632K that's frozen. And again, And three major organizations that help us for some account are near intense tether and circle. I do hope that there are more names that I can share with you. And hopefully, again, as an industry, we can make it very hard for hackers to launder stolen funds.

So now let's talk a little bit more about the recovery. You decided to offer a bouncy of 5% for voluntarily freezing a tax refund. funds and 5% for voluntary recovery. And this, I think, is sort of similar to what ByBit did. What other methods, I don't know if there's any other methods that you've used to try to get the fund, other than these public requests to get the funds frozen or recovered and just generally, like, how did you even come up with the amounts and, you know, how do you kind of approach this effort? Yeah, this we kind of just followed by Bates case.

We did have an internal discussion around like the exact percentage. And then if, for example, for those who help us froze the account already, do we pay them the bounty as well? And we decided, yes, we will also pay them the bounty unless they don't accept it. Then we want to donate the money maybe to some. third party non- NGO, non-government or nonprofit organizations, et cetera. So other than that, it's mainly following ByBITs case. We did have another group with ByBITs, technology and security team that we want to

learn from their actions, what they did, which proved helpful. So there were some lessons that we are learning altogether. Okay. And I also wanted to talk about the user protection fund. So you had $464 million that you could use for those stolen funds, which is more obviously than what was actually stolen. But talk a little bit about, you know, how you decided to even, you know, create one of these funds, how you amass the fund. And, you know, now that you have actually experienced something where you've had to use it, is there anything that you would do differently going forward when it comes to a fund like that? Well, this fund was actually established just a few months after I joined BigGit. That was the last fair market meet 2022 when a lot of smaller exchanges were running out of their cash or when bankrupted. It wasn't FTX yet, but a little bit similar to what we saw earlier this year in June, July,

that there were three exchanges consecutively just closing down or bankrupt or just simply run away. So in 2022, meet 2022, we decided to set up this big a protection fund. And indeed, for the last four and a half or slightly more than four years, we've never really had a chance to use the protection fund, at least not in such a huge amount. There were smaller amounts used to cover smaller incident or sometimes a little bit of users' loss due to instable system or so, but it's all very small amount. But I'm actually quite glad now that we set up this whole thing, and it is in open wallets. It was in three different open wallets before the incident.

Right now, it's still in three. But the amount of protection fund available in here did increase, I think, since yesterday because we started the Bitcoin withdrawal. We removed some money from protection fund to our hot wallet in order to deal with the withdrawal, potentially a lot, which is actually smaller than we thought in terms of the withdrawal amount. But right now, the Bigget protection fund is, valued at about 556 million, we did promise that we will get it back to 300 mil, which is a threshold that we told the industry about about one year after setting up the protection. Actually, the initial

threshold was 200 mil, but then we increased it to 300 mil, and hence we want to keep it there. So within a week, we are going to move our own company's capital to this protection. Fund and keep it more than 300 mil. Again, in open wallets, again, in mainly Bitcoin's as the core assets. Would we do something different about this protection fund? I don't think so. I think it's more about the security infrastructure that we would do differently. Protection Fund did serve its purpose as a self-established insurance sort of role.

and this time it's actually quite meaningful to, especially our users, that they know their assets are not affected because Figuett has this protection found as a protection. Yeah, so talk a little bit more about what you just said about how if there's anything you would do differently. It's, you know, how you would set up your security system. I'm sure so many crypto teams just from the sheer number of hacks we've seen this year are constantly thinking. about that. So, you know, what would you do differently for your security system? Yeah. So number one, again, this is something we will continue updating the whole community about security, about our incident report through different statements. But if I were to answer this question right now, by the way, I'm not a security expert, but I'll do my best to answer this

question. Number one, we will isolate a lot of, by the way, after the incident, we've already down this sort of isolation, like all the relevant servers and systems have been isolated from the network in order to prevent further compromise and to preserve evidence for forensic analysis. And at the same time, we are resetting all the internal credentials. I myself, over the weekend, you know, loving my own accounts a few different times. And of course, some of the services that were using, you know, delete this old one, install this new one. So as the whole team, we did a lot of credentials revoke, reissue, you know, render the credentials obtained by the attackers invalid.

And also for us as a system, the highly sensitive system sort of acts have also been also re-referred. revoked and restructured with multiple approvals now required for critical operations. So these are the main things that we did for the past few days. But there are a lot more plans that's coming up, which I hope we'll get another chance that we can share. And also, please understand that there is a very delicate balance that in terms of, okay, we want to share a lot of information with our industry. industry participants with our users, with our institutional clients, for example. At the same time, we can't share all the information because that actually just exposed

ourselves too much to other potential threats. Like now they know the exact structure of your security system and your team member, right? And all the vendors that you use, then they can target them more easily. So there's a balance that I need to maintain here by. sharing enough information, but not too much information. Yeah, yeah, that totally makes sense. So I was curious also, like if you had advice he would give to other crypto teams about how to handle things like third-party services?

Do a lot of checks on the third party. Yeah, this is definitely one thing that we didn't do enough. and we're going to change that. And another thing is, right now, I think hackers are using a lot of social engineering. By the way, just after this incident, there are still people who are targeting me. They know that this is the period of time

that I'm talking to a lot of external partners looking for help or just for better communication. And there were cases that they pretended to be from another major investment team who approached us and did something. And we almost started a real conversation. But along the way, I did another verification with the person that they tried to pretend and realize, okay, this is again scammers. And do you think that was PPRK again or just like a random?

I think it could be both. Yeah, it could be both. And I don't know exactly. So we are, this is still a lot of things that go on. But my point is for the current crypto community, especially. Like this is a group of people, like we are the group of people that heavily exposed when it goes to, you know, your crypto custody. your security, you know, have a very good habits, you know, change your password frequently, something like that, like quite basic, but please do the basic things very well.

And then if you are, you know, an organization like us who are custody in some of your users fund or a key protocol that has some like earning program, you have votes, etc., you do have a much more complicated security infrastructure that you should build. and you do want to check on every single possibility that you can be exploited and maybe just do another check and do another check. Okay. And so one thing I didn't catch that recent one that you think was another potential hack. That happened after this hack? Yeah, this is not a hack.

This is a social engineering towards me. But it happened in the last few days? It happened yesterday. Oh, wow. Wow. So they're taking advantage of the fact that you're in this moment of chaos. Yes. And they're trying. Oh, okay. Okay. That's that's really helpful for the industry to know that while you are the victim of a hack and you're trying to recover from that, that they are trying to target you again, which makes a lot of sense because it's a moment of having to do a lot of actions kind of quickly. So, so like the sort of slow vetting, that might happen is maybe not. It's just, yeah, you just have like, you're out of your normal rhythm. Correct.

So one other thing is I wanted to ask, like, I'm sure every single exchange has protocols in place to, you know, prevent a hack from North Korea. And, you know, I don't know if you can reveal too much about, like, I'm sure that you had simulated so many times how you might be targeted by North Korea, like, are there any tips that you would give about how you weren't thinking about that correctly or, you know, what you would do differently going forward? Well, I've watched a lot of North Korea targeting cases. So not this particular incident that we are facing because we will again publish more incident report to tell the public.

review like all the accurate information. But the general ideas behind a lot of North Korean incident target is that, again, it started off very likely as a social engineer. Like they know, especially the public faces in this industry, right? Like for me, they know I do a lot of interviews. They know I talk to a lot of external partners. They know that after this incident, I might talk. talk to this, this, and that, or I may, you know, seek help from this, this, and that.

So they pretend to be those people and just social engineer to you. This is why it's called social engineer. It's because they know your social status. And they can just pretend to be those people. By the way, for this particular case that I was telling you about yesterday, they actually formed a team because there were a few team members. in that investment firm who are famous. So they made it very real, like there are different team members

taking different roles and asking us to do different things or try to offer different helps. But I'm glad that I detected that, oh, this very much looks a little bit tricky and then checked through another channel that I really know the founder or the leader in that organization. and be aware that this is not really she.

So something like that. Like social engineering is a very important step one that you should hopefully identify. If someone who asks you to do an interview on a strange live stream platform, you know, if it's not the Google Meet or the Zoom that you keep using, they give you another software, I think this is highly suspicious. By the way, Laura, because this particular VDO ninja website that you guys use, I also, like the first bell when I look at this website, I was like, like ding.

And then I'm aware this is slightly less common than maybe stream yeah, but still common enough. But by the way, something like that, you just want to be very, very cautious when you see anything that may not. be a norm or it may not be, or even if it's a norm, you want to double check and when you see something suspicious, be very, very vigilant. Okay. I do also have to ask, so now that you have experienced this, how does it make you reflect on how your exchange has worked to prevent DPRK from laundering stolen funds in the past? Like, do you, I'd, you, you, I don't know what you can say about the approach that you took to that and whether or not it's, you know, causing you to make changes going forward. How we saw DPRK loaner funds, number one, they break it into very small pieces in terms of, you know, as small as like 10,000.

And they use a lot of very small exchanges. Like there were some exchanges when I look at those DPRK reports and incidents. They use something like fixed float, like a very small exchange that I've never heard. But it's a name that came out a lot. And they use a lot of privacy coin like Zcash or Montero. But I was wondering like on BitCat, like if you, I'm sure you have some program for that. But now that you're in this position, are you? you know, looking at how your exchange does that to try to do it like in a better way going

forward? Oh, in terms of how we build our system or in terms of how we... To prevent DRK from using BitKet to launder funds on Bigget. Oh, oh, well, KYT, KYT and because we do have all of our users KYC'd. So Bigget and many major exchanges is not like their number one choice. sometimes the very small amount go through us and we help them phrase the account. But for sure, there are things that we can probably even do better. But I think have your users K-YC and do enough K-YC, K-YT, K-YB

is probably a good starting point. And hopefully, we were also discussing the other day that maybe we need a more alliance sort of setting for this industry. at least, you know, among the top players, like the top exchanges, the top security firm, the top intelligence regulators or firms that we can, you know, hopefully build a system, build an alliance that can prevent more stolen funds, laundering, and bad behavior activity happening in this industry. Okay, so we're at time, but I do have two more questions if you have a couple minutes to go.

Oh, okay, great. So there's just something I was so curious about. I'm sure you have seen, well, at least I have seen. I don't know if you have seen, but in the past there's been means going around the industry whenever there's, I mean, it could be actually any number of things that happened. But it appears to be crypto-specific where they will create like a little grid of four Asian female CEOs and make disparaging comments about them. And I saw like similar memes or similar comments about you. These these are comments saying that like Asian women CEOs are fronts for the real founders and things like that. Like I quoted Zach saying something similar earlier.

I'm curious what response you have to people who have been making those comments in the wake of this hack about you. About me being a female CEO? Well, they have some theory that Asian women CEOs are fronts for whoever's the real power player, I guess, behind the scenes. And they were making these comments about you as well. Maybe you didn't notice, but. I have to say, I'm not, I'm not, indeed, I'm not the founder, right? The company was started eight years ago. I only joined about four and a half years ago.

But I'm CEO and I manage a lot of things. As for the accusation of being the face or what, I mean, if I can be the face and I can make our company more powerful and influential, I don't mind them. calling me this. And I think the key part is what's the value we are creating or I am creating and delivering to our goal. And then what are the messages we are sending to the whole industry. I think those are the key part that I care a lot more. Rather than, you know, people calling me face or flower or whatever. I just don't care about it. those things. But they're right. Like, I'm not the founder and I'm just CEO.

Oh, okay. Yeah, I don't know if you fully understand what I was saying. Just like, like they're, they're almost saying that like just because you're a woman or an Asian woman or something like you're not the real. I didn't mean that it had to be the literal founder, but that you're not a real CEO, I guess. I mean, there are so many, female, Asian females in all the industries, right? In crypto, yes, in even AI. I don't think being of Asian female have any issue because there are so many Asian females

who prove to be very powerful and influential. I will try to continue work my best towards delivering better results for our industry, for this, you know, in a crisis like this, how we deal with it. I just don't think being an Asian female has anything in terms of this. Okay. All right. So let's just talk about, you know, now that you're hopefully coming out of this incident,

I'm curious, like, now that you are, have started withdrawals, are you seeing that people are withdrawing more than you expected? or are you seeing fewer withdrawals than you expected? Yeah, what's your take there? Yeah, there are actually fewer withdraws than I expected. Actually, today, because yesterday we started the Bitcoin withdrawal. Today we started the Ethereum withdrawal. The Ethereum withdrawal started today at UTC 8am.

We actually saw a new, saw a net inflow after one hour of, of that withdrawal open. Like today, the Ethereum inflow to Bigget is 9,674 Ethereum, without flow, approximately 9,023 Ethereum. And that's the data after one hour of the withdrawal open. So that's the sort of number we are seeing right now. Again, I really appreciate any users who decided to stay with us. And hopefully for those users who we lost these days,

we can win them back one day with our dedication, with our good activity, that we can attract them. And hopefully there will also be a lot of misunderstanding, clear that we actually plan to organize a series of, for example, security one-on-one with our key clients. And then incident report is also part of it, like being transparent about what happened, about the actions that we are taking, just a lot of activities. And gradually, the whole company is already back to normal business.

But we know we needed to do a lot more than before to win our customers back. Okay. And last question. So the exchange plans to IPO in three years? still on? And if so, does the hack change those plans at all? I don't think the hack changes any of our major financial plan. Yes, we talked about potentially having an IPO in the future. It is still on the roadmap. And even after the incident, we've been very communicative with law enforcement organizations, with different

regulators. While whether, you know, certain regulators may feel this is an incident that they don't feel comfortable or so, I'll leave it to my legal team to, you know, clear the air out. But we did be decided to be very transparent and share those information. And this is the case that, number one, we are a victim. Number two, we are also showing the industry that we can handle this very well by being transparent, by being investigative, et cetera, that we do think we can become stronger coming back.

All right. Well, thank you so much, Gracie, for sharing your time during what is, I'm sure, it's very stressful period for you. And good luck recovering hopefully as much of the funds as possible. Thank you, Laura. And thanks everyone for joining us. Nothing you hear on Unchained is investment advice. This show is for informational and entertainment purposes only,

and my guest and I may hold assets discussed on the show. For war disclosures, visit Unchained Crypto.com.