Inside Bitget's $388M Hack: How the Attackers Got In

Transcript

doing it. We're moving at the speed of willpower more and more every day. So I think this AI agents is a is a extraordinary development. It's why I think semiconductors are a great opportunity. Uh and Meta is first out there. But yeah, Google is coming. Google Spark is in testing right now. It's going to be compelling. Apple sees this. Everyone was going after the personal assistant AI. It was the obvious thing. But there are other AIs coming. The personal concierge, the personal doctor, the personal wealth manager, what we're building at Luma. All of these niches are going to get filled out. So I think it's super exciting if you're long the AI trade and we're going to be mainlining AI now to consumers. Right now it's been mostly an infrastructure and compute story. This data center policy abstract concepts.

Now consumers are sourcing tangible value like when they first got their AOL CD and went on the internet. Right? That's what's happening now with these personal assistant agents. >> Historically governments have always picked inflation if they can. Right? We've done that in the United States repeatedly. If you look at the history of the 40s and 50s postwar, financial repression. If you were to go and then look at the 70s, financial repression, right? Like every time we get into that position, we end up in that way. And I think with debt to GDP where it is, there's a sort of counterintuitive thing that starts happening, which is if you have $30 trillion of debt outstanding, right? I will remind everybody 1% of the debt is $300 billion. If you raise rates 25 basis points, that's a lot more free

cash flow in the hands of Americans given that our debt is relatively short-term and rolling quickly, right? Like there is some bizarro like inversion of thinking that happens when the debt gets big enough where rate cuts are no longer restrictive, but in fact just spray more cash out as well. >> They say the rise of agentic AI and machine-to-achine payments will likely increase demand for blockchains and other programmable payment infrastructure, stable coins, native crypto assets, etc. existing rails such as a card networks blah blah blah um make them less suited to to always on very low value transactions requiring pro programmic execution. So what did Brackrock basically say? They said there's going to be a billion agents in 2027. They said the billion agents are going to be doing 217 billion transactions a day and those

transactions are going to be settled on blockchain rails because traditional existing rails like a just aren't relevant for those kind of transactions. And then you say okay what's going to capture that value? layer ones, hedging mechanisms, dexes, because they're going to be trading in and out of different tokens. And then you start thinking to yourself, hold on a second, maybe this chart is actually conservative. Maybe maybe the altcoins actually outperform Bitcoin by 50x. Why? Because whenever you use a protocol, ask yourself a question. Could an AI and will an AI actually use this protocol? Salana. Yeah, Salana could AI could use Salana. Hyperlquid. Yeah, AI could use Hyperlquid. Near intense, yeah, AI could use near intent. Now, how much more so when the validation is not only likes but actual money and that's what crypto's created. It's created

transparent trading machines where everyone can see P&Ls and people are starting to share it. So, if you look at like apps like FOMO, pump Fun, we've created a master use case in crypto which is dopamine-driven social trading. And what I think is actually going to happen if you take that and you combine that with a tokenization of everything. All of a sudden, you've got this industry which is a combination of a casino and a social network, but instead of casino, let's call it an an investment house. an investment house with a social network. And now that's a monster business that's more powerful than any social network. And in fact, I kind of think that Elon Musk and Twitter have seen this because they're starting to incorporate trading into your Twitter. And people that are testing the the Twitter buttons and so the ultimate social network doesn't only reward you

with likes, but actually rewards you with increasing net worth. I do say one thing, I'm watching Zcash, and it reminds me so much of Bitcoin back in 2016 and 17. It's the same people. It's the same kind of movement. It's the same price moves. Like I remember when Bitcoin went above $1,000, how quickly it went to $1,500. And that's exactly what happened with Zcash. Like it's it was at 600 and it's like 700 and then like 800 and then it went through a,000 and then like within 2 weeks it was at $1,500. And I it's deja vu because I remember the old Bitcoin days and I'm just waiting for it to go back down to 700 and everyone to get scared and then it'll just go back up to 2,000 because that's what Bitcoin did to us in the old days and it was the same faces. Like I

saw the Vinklvos brothers are speaking at token 2049 and they're speaking about Zcash. I was like wow I I swear I've got a a similar leaflet from 2016 or 2015 or whenever it was of them speaking about Bitcoin at some conference. And so like for me Zcash and the whole privacy around Zcash is super super super interesting. I think it's more useful than Bitcoin. I know you're not supposed to say that because Bitcoin is the king of coins, but there's a better use case for Zcash than there is for Bitcoin. You know, private money is much more valuable than public than than transparent money that everyone can see transaction history, right? So, I know you're not supposed to say that Zcash is maybe a little bit more interesting than Bitcoin, but can't help thinking it.

>> If you were to set up a system that was designed to generate a lot of volume in the most efficient the the funny part about who are the people who would generate half a billion dollars in volume off 3 million of open interest? People who are hyperefficient. Who are hyperefficient? Market makers. That's their job to be as efficient as possible in, you know, what they do, right? So, if you got two market makers and put them in a room and said, "Hey guys, I'll pay you $1 every time you cross each other." Those guys are going to rip your face off. They're going to create so much volume you wouldn't believe it.

Now, the question I guess, right, is does that have any benefit to an end user? Because that's the difference between wash trading, right? even if it's one person, two parties colluding together or whatever and like incentivized liquidity. >> It's not an LLM that talks to you like a lot of information goes in and then a classifier this makes decisions for you and those decisions come out with weights and the thing is way cheaper and way faster like 200 milliseconds fast. So instead of you let Babel drive your browser and every pass is like I'm going to take a screenshot of this whole thing and I'm going to find the thing I'm going to click and then it it gives you like three paragraphs back about what it's finding. This thing is like I'm going to look at everything and I'm

going to make a decision based on weights and I'm going to choose the thing uh within 200 milliseconds. So it's a classifier and it's making decisions very fast and it's very cheap. So, I think that's it's just like we're going to see on on my my podcast, we kind of talk about the this tension between effective and efficient and you always do it effective first and then you find a way to do it more efficient once you're doing it effectively. I think we're going to see lots of different types of new kinds of models like Jev where it's doing nearly the same task. You know, as long as it's not a chatbot, you're chatting with it. It doesn't do the chatbot thing, but it can do a lot of these tasks and CI type things and browser use type things way faster and way cheaper than just letting

Fable click around. >> You're using a travel agent. You're not paying for the hotel directly. Like you're not paying the hotel directly. Well, I mean, I guess you could, but yeah, in this case, you're not uh you're you're doing a sort of a private concier, so to speak, because obviously for something to be like a store of value, you need to hold value in it, but then you need to also be able to do things with it to an extent, like things backed by it. I'm upset that like not everybody uses it, but I think a good enough amount of people use it such that it does make a difference is sort of like if you use the Zcash wallet, they all have the pay feature which integrates near intense, which then lets you pay on any chain, right? So you can also I also do Salani USC with this for

example or you can do Ethereum or you can brush to Robin Hood whatever and it's just super convenient and like it's not like a regular bridge where you can just go back and be like oh it came from this other address okay now my private concierge knows how much money I make and therefore now they're going to upsell me on all these sort of different >> importantly I think biggest unlock has been both Zcash and Mir bringing at last privacy on chain to me it's always been kind of a biggest bottleneck to use day-to-day blockchain or anything because like I I have literally a spreadsheet of 100 addresses on Ethereum and kind of near before we had privacy.

So I can track where who where did I send money which address did I use how much gas I left on that address like it's like a it's a nightmare of like accounting system to just keep track of you know to make sure I don't link anything you know go through sex you know make sure I don't have timing attacks on like amounts etc and all that it gets solved now that we have Z cashmere really delivering on kind of like how do you have a private experience using blockchain so I think like all these things really coming together now uh as more and more people actually starting to use blockchain financial system is moving to blockchain kind of never before. And so at least that's my explanation why things are really uh really starting to appreciate.

>> One more thing, we've got a listener survey open. It takes just a few minutes. It's anonymous and it changes what we make next. Use the QR code on screen or go to unchanged crypto.com/servey. The link is in the show notes. $540 million. That's how much concentrated liquidity sat idle in a given week in the first half of this year. About 30% of the DeFi TVL if you're wondering. That's according to Dune Research commissioned by 1 in. But there's a solution. 1in Aqua is the new shared liquidity platform. It lets LPS back multiple positions with the same token balance and keep their tokens in their wallet till a swap comes. Why does

that help? Because LPS don't have to split their tokens across positions. They can cover more market conditions and pairs with their full balance. That means more activity across deeper liquidity. See how it works at 1 in.com/ aqua. Remember that providing liquidity carries risk and fees aren't guaranteed. Before we dive back in, a quick word about something we make ourselves. If you like the way we cover crypto on this show, cleareyed, no shilling, just what actually matters, you'll like the Unchained Daily. It's our free newsletter that lands in your inbox every weekday with the most important stories in crypto written by journalists, not marketers. No jargon, no hype, no number go up cheerleading, just the news you need to stay ahead in

the time it takes to drink your coffee. Subscribe for free at unchainedcrypto.com/newsletters. Heads up everyone, we've now fully transitioned Bits and Bips to its new dedicated channels. So, if you're not yet subscribed to the new Bits and Bips channels on X, YouTube, Spotify, Apple Podcast, or wherever you get your podcast, go there and Heat. Heat.

Down. Everybody Jimmy hey feeling feeling it feeling.

Heat. Heat. Hey hey hey. Heat up

here. Jack. Hi everyone, welcome to Unchained, your

no hype source for all things crypto. I'm your host Laura Shin. Thanks for joining this live stream. First, we'll take a quick word from the sponsors who make the show possible. This episode is brought to you by 1- in Aqua, the shared liquidity layer from 1 in. Back multiple liquidity positions with one wallet balance and keep your tokens in your wallet until a swap fills. See how it works at 1in.com/aqua. Not listening to Bits and Bips yet? It's our weekly crypto and macro market show with Rahm Alawalia, Austin Campbell, and Chris Perkins. Search Bits and Bips and subscribe.

Today's guest is Gracie Chen, CEO of BitGet. Welcome, Gracie. >> Thank you for having me. Always nice to see you, Laura. >> Yeah, nice to see you. Sorry that it's not better circumstances. Bit was just the victim of a huge hack for a total of $388 million. This bears a number of hallmarks of hacks by DPRK. Let's go back to the beginning. Tell us about that day. I think you found out in the middle of your night. So, um, first of all, tell us how Becket figured out that it was being hacked and how you learned about it.

>> Sure. Yeah. So, beginning at 6 um 31 p.m. UTC on September 24, we saw some unauthorized transfers. Actually, 6:31 was the first um first round of unauthorized withdrawal and that's very small amount. I think the attacker or the hackers are actually very smart that they just did some testing transfer 0.48 Ethereum from a ETH hot wallet and the 93 TRX from a Tron hot wallet. Both were below the risk control threshold and did not trigger a system alert. But at 658 UTC that day, uh the attacker initiated

17 uh starting from 658 actually. So uh so 650 is the first time stamp but basically attackers initiated 17 large transfers across different chains and different assets with a total volume of uh approximately 361 million that we were stolen during that time. Um I I figured actually our system figured this out much earlier than I did. So 7 minutes after the first large transfer uh our platform's reconciliation system detected a significant discrepancy and the risk system automatically blocked all the user initiated withdrawal platform wise. But this didn't really uh

fully stop the bleed uh because the hackers were very smart that they uh they they actually hacked into our internal system uh using a third-party zero day vulnerability. So they exploded this vulnerability to gain access to a critical internal management system and then uh as a impersonated identity they then created some withdraw fraudulent withdraw commands and caused the wallet service to execute those transfers. Uh so the attacker just accessed the wallet related backend servers and directly inserted fraudulent withdrawal comments

into the wallet system. Hence the wallet system you know sent out some transfers and even if the um the risk system that reacted uh that didn't really stop the bleed at that time. Uh but at the same time another thing that the attacker did is also erasing traces and that's why it took longer and and become harder for us to identify the root cause. Basically the hackers what they did is after completing the transfers the attacker deleted all the traces that the fraudulent withdrawal comments might have left behind in an attempt to uh to conceal the attack and hinder the root

cause identification. So due to the lack of direct evidence we needed to examine a broader range of system to identify the root cause during this incident. Um what for for me personally I uh I just happened to woke up about one hour after their first major transfer. Well at that team my especially my technology and the security team are already full in in full house like full steam working on that already but they they also uh haven't haven't really caught me but I I woke up myself. Uh that's a that's a coincidence but I'm sure even if I didn't woke up I didn't wake up my team may may might have caught me in about 10

minutes time. So uh when I woke up that was my 4:00 a.m. and I saw some uh text messages uh on the working phone and I started to you know together with our technology team see what we can do. Um, and I also decided to be on a live very quickly because I figured this is a time that the whole community is speculating because all the things are onchain. People can see uh there are also external like voluntary based uh white hat uh white hat hackers like seal 911.

Uh I know their founders Samzun and um and a couple of other voluntary white hat uh hackers. We we've already been in a telegram group for many years because we help each other tracking different funds. There were cases that some fraudulent funds went to big and we helped them froze. So I saw from that group like the external community are already discussing and asking us. So I wanted to be very upfront answering questions and facing the community directly.

>> Okay. Yeah. I mean it's really impressive that you got on that live so quickly. Um and it was um sort of reminiscent of when Ben Xiao uh of Bybit also did something similar. Um, I did want to ask, you know, about the fact that they did the test transactions and and um and also had covered their tracks because I asked Taylor Monahan what she would ask you when she basically asked why there were these transactions that spanned over what what she thought was about three hours. Is that is that accurate?

>> Oh, okay. >> Yeah, that's that's accurate. Um the first large transaction as mentioned earlier was uh 658. Uh the last transaction was at 9:23. So that's less than 3 hours from the first testing transfer. >> Okay. And so was it because um they had covered their tracks that you weren't able to stop that one that happened almost three hours later? >> Uh I think there are mainly two reasons. The first one is what we discussed earlier like finding the roots and uh uh and and do the remediation took it took longer. But we did uh one one specific

important thing that we also did in between the two rounds of their attack is that uh there uh there were actually um technical um containment measures that that my technology and technical and security team did. But at that time we cannot uh we cannot rule out the possibility of a private key compromise. So we again switched on uh certain buttons and allowed the different wallets to make transfer. So that what we did is we collected all the money from the hot and and warm wallet back to cold wallets and that gave the uh hacker

another chance of doing attack but but the the amount is much smaller. The total value of uh the second round of attack is uh about 30 million and that's from 855 to 923 because we switched on the system again and allowed them to to give gave them another chance but we needed to do that because there were far more than 30 million on the uh hot and the one wallet that we needed to rescue. Um so there were mainly two rounds and in between there is this um you know important discussion that we needed to make and there are so many possibilities. So a huge difference

between beets hack and by bits hack is that by bits hack the root was quite clear right it's a safe wallet front end issue that touched their cold wallet but our issue is very different it's hot and warm wallet and it seems like it's it had it can have a lot of different causes and that's indeed why it made it much harder to identify the root cause because it involves a lot of systems and a lot of different public chains.

>> And then what can you tell us more about the third party system that was hacked and how that transpired? >> Um I I can't disclose the third party name nor the exact vulnerability. It is a security product that we used to hopefully make it more secure. Um but but the vulnerability is a zero day vulnerability. it means it's not it's never discovered before. Uh but the the key thing here is I don't want to blame external party. We are taking the full responsibility. Uh and we are going to publish a incident report very soon probably today or tomorrow but

definitely within a week that can give you more details and give the community more details on the uh you know the this this vulnerability itself. But I think in general we've also um want to you know we've already notified the vendors about their vulnerability. Um so there are a lot of things that we are we are doing together and this is still an ongoing uh incident right. So other than the hack itself right now I think the uh we as a team are looking a lot about number one business and operation wise how can we win our users back? How can we get all the business as usual and then at the same time watch and uh uh

trace all the hackers activity around the money laundering and we actually worked together with a lot of different decentralized protocols. Uh I know you guys covered this yesterday like there were protocols that say that refused my request of you know phrasing uh certain addresses not serving the hacker. There are also other D5 protocols that uh that came out and said, "Oh, we helped you froze your accounts and we are not interested in the bounty because we want be get to recover more." I think right now I see a lot of different faces although they are all doing D5 protocols and as a community or as a an industry participants I really appreciate whoever

at this stage are helping us you know avoid um free some some of our stolen funds and then not allowing the hackers to uh easily launder the money. >> Okay. And out of curiosity, was the third party vendor one that is familiar with the threat level for for crypto companies? Like was it a a security company that um you know also understands kind of just uh that there's a heightened level of security needed for crypto companies or were they more a general provider?

>> They are slightly more general provider. I would say if you are not a crypto company, you might have used their service as well. Uh but again, I think this this part is easier if we leave it to the incident report to answer more, you know, thorough question rather than me disclosing too much. >> Okay. Well, one last question that I have to ask is whether or not social engineering was involved. >> Uh I can't answer that either. Uh but I I I'm I can I can assure you that um if it's Lazarus they use social engineering a lot and social engineering is a common threats targeting um the whole industry but for this incident exactly. Uh I I I

can't I can't answer that question. I'm sorry. >> Okay. Okay. Because obviously after drift that's what's on everybody's mind and that one was was so chilling. Um, but I totally understand if uh you want to wait until you have your fully polished explanation to release. Um, all right. So, we're going to go into more details around um, you know, which assets were affected and which chains and what happened to the um, attempt to recover those funds. But first, we're going to take a quick word from the sponsors who make the show possible.

$540 million. That's how much concentrated liquidity sat idle in a given week in the first half of this year. About 30% of the DeFi TVL if you're wondering. That's according to Dune Research commissioned by 1 in. But there's a solution. 1-in Aqua is the new shared liquidity platform. It lets LPS back multiple positions with the same token balance and keep their tokens in their wallet till a swap comes. Why does that help? Because the LPS don't have to split their tokens across positions. They can cover more market conditions and pairs with their full balance. That means more activity across deeper liquidity. See how it works at 1 in.com/ aqua. Remember that providing liquidity carries risk and fees aren't guaranteed.

If you like this show, there's another one from our network you should be listening to. Bits and Bips is our twice weekly market show. On Mondays, Rahm Alawalia, Austin Campbell, and Chris Perkins chat about where crypto and macro collide. It's sharp, it's fast, and it has its own channel. Search Bits plus sign BIPS and subscribe. Back to my conversation with Gracie. So, um, as you mentioned earlier, there were a number of affected chains, um, Ethereum XRP Arbitum Avalanche Optimism, BSC, Base, Zcash. And um I noticed that Zcash was actually listed a

day later maybe or something. And I just wondered um like why why it was not noticed initially. >> Uh I think there were two public chains actually. Is it Zcash and TIA or Zcash and Tron? There were Zcash and and another public chain that we uh later on discovered that's also involved in or or affected in this incident because it's a relatively smaller assets and uh uh public chain used at our platform. So that wasn't on the first round of attack like the detection. It wasn't really because Zcash is Zcash and Zcash as a

privacy coin do have very different features than many other cryptocurrencies, but it's mainly because it's a smaller chain. >> Okay. Okay. Yeah, I just was curious about that. Um, so I then also wanted to ask, so I'm sure that the exchange has protocols in place for situations like this. you kind of mentioned um you know earlier the move to move to transfer a large portion of the funds in the hot wallet and the um warm wallet to the cold wallet. So I was curious like if you had any other um you know insight you could give us into what the plan is because obviously uh the the pause on withdrawals I think happened later and I

wondered kind of why that wasn't uh you know put in place earlier. Um uh the the part of the withdrawal actually were detect were uh were automatically switched on at 7:05 the the the power we said uh 7 minutes later then the 7 minutes after the first large initial transfer. Uh so we've already like the whole the whole gra system already automatically blocked the uh user initiated withdraw but the part that that you were asking in terms of like us um naming it as a withdrawal pause is

slightly later because actually at that time whether we stop withdraw or not doesn't really um make the difference in term because the the user sorry the hacker is not doing a normal user withdrawal. Um if if that hope hopefully that answers your question. So so later on it's more of just um just just users cannot even do the withdraw button um and and for us the withdrawal paused slightly earlier um at 7:05 when the system detected this significant discrepancy. Okay. So, but then I don't understand how they were able to do the

subsequent transactions. >> Uh because it's not normal user withdrawal. It's uh it's at the back end server sort of withdraw. >> Oh, I see. I see. They were just using a totally different mechanism. >> Okay. Okay. Um All right. So, let's now talk about your attempt to recover uh these funds because obviously I did see that you reached out to a number of different foundations across these affected chains. some of them had frozen the hackers wallets and I wondered if you um you know because there's a lot of discussion on the timeline about which chains can do what um and so you know from your discussions with them I don't

know if you could uh help illuminate what determines whether or not a foundation can freeze wallets or not. uh I I don't have much information but I do uh I don't have the firsthand like expertise on this. I do have another team member actually a few team members who are more hands-on in terms of understanding the mechanism of this public chain and that public chain but I want to highlight like so far there are a few organizations who are being very helpful. Tether Circle. These two stable coin issuers are the uh first two batches of um organizations who help us froze some stable coin on on the uh on that that's from our stolen funds. And

then yesterday near intend also help us froze another uh I think it was 550 uh 500kish sort of uh different crypto that went through um the the the near protocol. Uh not the direct near protocol but the near intent sort of uh swap water swap I think. Uh but basically these three right now are the main sources of um organizations that help us froze the some some accounts and some uh addresses. But I think the recovery is just another story. Recovery is different from phrasing. Phrasing is slightly easier. Uh recovery we need to

go through a lot more especially legal procedure which we are doing our best. Um but again I I don't think that's a huge source of funds that we are looking at to get back. Uh for example if you look at by bits hack uh after one year the by bits stolen fund of more than 1.4 billion there were only 3.5% that's frozen and then the part that they got to recover it's much smaller. I just hope that that this time we can do better than 3.5%.

Um but I don't have much hope honestly. >> Okay. Okay. Yeah. I mean um I would imagine so what happened last time was that with Arbitum they were actually able to freeze 71 million. Um, but that involved getting the arbitum security council involved and with Circle and Tether because they're apps, you know, on these chains rather than chains themselves, it's just a much easier, quicker decision. Um, but I did want to ask about, you know, Circle because they were criticized in the past repeatedly, um, but especially, I feel like, for, um, the drift hack for not acting and

instead allowing the stolen funds to move freely. And obviously, you know, this time around it was a much smaller amount that they were able to help out with. But why do you think that they or I don't know if you have any insight into why they moved to help at all because that was sort of new for them. >> Uh well, I didn't follow the drift case in terms of USDT or USDC or circos action that closely. So I don't know the details in terms of how the drift case is different from ours. uh all I can tell you is uh circle actually moved quite fast in this situation. I don't know if it's because you know they they decided to change some protocol uh rules or maybe it's because the case are

different. We published all the information very very quickly right we uh we publish a dashboard that follows all the uh stolen funds addresses and it's still alive. will keep it alive a long time. By bits, Lazarus, they have a Lazarus bounty website that they created right after their hack. Right now, if you go to that website, the the the the first page dashboard is still is obviously ours. So, there are maybe as an industry we all evolved. So, but but again, I don't have the details on the drift case. So, it's hard for me to to tell you like why this time is different.

>> Okay. Okay. Yeah. Um well, yeah, it's it's definitely noticeably different because we actually did a whole episode on how they did not um act at all for $280 million or something like that. So, um yeah, I was surprised to see that this time. Um there's another actor who appears to have changed his stance during this um incident, and that's Zach XBT. earlier this year, he tweeted about I mean there were a number of these but but he tweeted about some pump and dump activity that he saw that he felt originated on bit um also on gate and Binance. He tweeted um Shaunlu is the big big boss who allows these scams to

operate behind the scenes while Gracie Chen is only the face of it. The Chinese sex cartel has gone unchallenged for years and doesn't care as long as they benefit from the activity. And then he said,"I think it's almost time to increase public attacks against BitGet." And later he tweeted about a token uh lab token which he called a market manipulation scheme via spot. And he was saying that he thought 95% of the supply was held by insiders. And again during that he was calling out bitcap because I guess he traced that a number of the insiders had withdrawn almost $500 million from bitcap. So last week after, you know, news of the Bitad hack went out, he initially tweeted, "I have no

current plans to monitor the Bit exploit by DPRK. I stopped wasting my time on helping people in the industry who are not supporters of my work, donors, clients, longtime followers, etc." So it sort of seemed he was like throwing shade on your exchange. Um but then on Monday he tweeted that he saw Chinese illicit actors trying to launder funds for DPRK from the Bickette hack asking for help in Discord. He identified five aliases that were being used. He uh you know not he um revealed the transactions that were tied to those aliases. So, I was curious like what happened in between the initial announcement that he wasn't going to work on this and then uh you know the time when he actually noted

where some of the funds had gone. >> Uh I I don't know you should ask Zach this question. Uh I we we did talk to him and uh among many other onchain researchers, voluntary like the those uh white hat hackers that I told you about and some formal companies such as slow mist and mandant that we formally engage and we are drift uh uh we they are helping us independently research and come up with incident report. So we our team actually I didn't talk to Zach directly but we do have a dedicated team uh that consists of technology team um

blockchain expert from our team listing team who know a lot of people in this industry that they are working together to talk to onchain researchers I don't think we formally uh sort of like like paid Zach a retention fee to start uh investigation nothing like that um so so maybe he is just you know looking at the the so-called uh Chinese illited actors laundry money and he that he find it hilarious. I actually saw that post and I when I saw the Discord conversations, I also find it quite hilarious like you you saw you saw someone um said, you know, you you chose the wrong job, pal.

And I made a made a made a a fun comment on on Zach's Twitter post saying, yes, indeed they chose the wrong wrong job. Um, but other than that, I we're not like formally engaging Zach. But I do appreciate him and anyone uh right now in this industry who are who are who cares and uh uh and who are working together to make it very hard for the hackers to launder our stolen funds. And do you have response to his allegations from a few months ago where he felt like these pump and dump schemes were either originating on your exchange but then also um you know some of the teams were cashing out from your exchange.

Um I well all these cryptocurrencies if you look at many of the the name that that he specified they are all listed on many exchanges. uh they are typically also listed on on Binance and and on you know gate bead by a bit okay like all the top exchanges sort of um have listed this token so I I can't really respond to him saying you know pump and dump only happened at big because uh because it's it's a it's a u it's available on many exchanges and then maybe we can uh discuss further in another chance after I get a get a chance to look at the the

specific pump and dump activity that he is referring to but right now I don't have a response on that. >> Okay. And from his identification of those aliases in the transactions did that enable you to either get some of the funds frozen or or even recovered? uh for this one particularly I don't know because this uh this post that he tweeted was only yesterday and uh and I have team who are covering this which they haven't told me specifically about um whether this particular information is helpful or not. I know the the the near intent thing because they updated me that it's it's quite useful and they are approaching like my team is

approaching near intent. They have a TG group set up already. they are discussing the exact procedure we should to we should take from our legal end in order to you know hopefully recover those funds. So those are they are some something that I'm updated hence I know uh for the Zach part I I'm not updated so I don't know yet. >> Okay. So yeah well what actually why don't we talk more about uh your intent. So um so this is uh going to be a setup for kind of a contrast that we're seeing from uh different teams in the industry to this hack. Um so let so go ahead and and talk about what it is that near

intense did that was so helpful for you. Uh the yeah the well near intense I first of all I also just learned like shel system uh through this article that the near intent CEO just wrote uh Alex he talked about how uh near intense as like they build this shelled thing that that's basically a raised intelligence layer protecting near intent and also uh protecting near in a way that basically it automatically detects any uh deviations in flows and collect a lot of inputs from KYT transaction and uh

providers independent researchers and then based on all these signals that the protocol can decide whether they want to you know allow a particular transaction to happen or not allow or or not. So their stance that that is um permissionless doesn't mean neutral that they should um basically refuse to help launder stolen assets is a key point or a key stance that they are making which in my opinion is of course I I really thank thank them for that because um as I pointed out earlier to another D5

protocol that that we publish all these data on the back on the dashboard. Those are obviously laundering flows and stolen funds and we hope uh the protocols can react to them. Uh but but whether whether they can or not is a a technical problem. It may it may also be a governance problem. And each individual D5 protocol works very differently. that is totally like a new world that I'm not that familiar with. I know some, you know, high level concepts. Um, but for the exact protocols, we just want to, you know, appreciate any any anyone that in this case say said something like, okay,

peritioness doesn't mean neutral because I do think that should be the case. uh if it's so easy for those hackers to launder their money obviously there will be more hackers and there will be more hacks towards uh the the major players in this industry or even small projects right like along this this um uh few years that I'm in this industry I've seen a lot of hacks towards big ones towards smaller ones but in total hackers are one of the largest enemies of this industry and we should all stand together to fight them rather than allowing them easily launder stolen funds.

>> Yeah. So now let's also talk about Thor chain as a contrast and then we can kind of tie this together because you publicly asked our chain not to service the addresses that were associated with the hack because there was laundering that was flowing through there and I have been seeing some conflicting takes around how much control they have to block these transactions. There's a lot of Thor Chan stands I Thor chain stands who are saying that they you know it's permissionless blah blah blah but as far as I understand I think they have an admin key so um you know what's your like like when you made the request what was your understanding about their capabilities um to you know potentially block the laundering of the stolen

funds. um my okay so so that at that time I don't think I um I know exactly how their governance work nor neither do I know it now uh the key thing is it's quite clear that again those are public information that we listed and keep track and hence I just decided to formally ask them to refuse services to the addresses of course by asking them it could be their team members if they are very much like uh there's a core foundation or it could be the nodes and

the swaps on that public chain uh or so uh of course later on I also did more research I realized yes there were cases that they shut down the system because of some other hacks especially some hacks that they they themselves were victim Uh but in general it's not something I want to you know just targeting thorn chain by saying oh you you are you should you should change your protocol from permissionless to be something else. I think what near intent did was quite interesting that as a solution uh although the publishing still is uh permissionless but you can build a layer

on that to do more KYT to um to avoid the hackers found something like that. Yes, I did see a lot of different even there are some major uh industry leaders who are even our competitors right like they came out and uh accused thrron chain for being um not standardized their their standard like when it's it's them being the victim okay they can shut down the the system and u and when it's not them it's us they they just refused it I I saw the thorn chains uh official tweet to refuse my request. Uh but over the weekend I I still had a lot of

things to do like more than 100 things on my list. So speaking to throng chain wasn't a major one. Um but I did later on reach out to them through third party privately and I wanted to you know hopefully schedule a meeting with them uh to understand how their protocols work and what we can potentially do together. I also made this as a as a shout out or or call out yesterday at another podcast uh said you know thorn ch I want to talk to you and and let's uh let's sit down and discuss. uh but other than that I don't have a lead now with thorn chain um and there are still

a lot of funds that we can chase after and my teams are uh working around >> and but have you f like when you had the private conversation did you find that they were amendable to helping you in any way or >> No I haven't I haven't had the private conversation I reached out to them through some third party people but nobody gave me a firm lead to their core developer it. >> I see. Okay. Well, so now that you're in this situation and you're seeing this whole discussion kind of around like what different actors in the industry should do in an incident like this, like I mean you started to expound on that earlier, but I don't know if you have further thoughts on you know you know

what types of organizations should move to act like when the principles of decentralization and permissionless permissionlessness should uh you know be prioritized like How do you think about this now that you are in this situation? >> Uh well last last year when I was looking at bid situation uh I was quite surprised that as an industry we can't stop the um the the the bad behaviors or the hackers launder their money. Now I'm experiencing it but still there are some parts of it that I don't get why. Um, so back to your question, I would first call out to, you

know, public chains and protocols that they should not hopefully that they they they do not need to choose between being open and excluding hackers. Um and we for us all we can do is um you know call out and then for those who can phrase some of our fro frozen accounts that we want to you know follow the appropriate legal and recovery procedure so that uh like the near intent pointed out they uh they needed us to do that so that hopefully they can recover the funds for us. So so that's exactly what we're doing. uh but more collaborations.

Um I know there were a few team members of mine who are did who are um on this specific project of chasing after the loan fund. They uh they have been engaged in many groups. They gave me like a daily update. Um but so far we are not seeing a lot of progress. If if you look at big um actually let's take a look now like we have a dashboard of um tracing all these funds which is called trace.bgblockchain.xyzv2 XYZV2 um explorer. But if we look at the frozen amount right now out of the sto total stolen uh amount of 388 million

there are only 632k that's frozen. Um and again three major organizations that help us for some account are near intense tether and circle. I I do hope that there are more names that I can share with you and uh um and and hopefully again as an industry we can make it very hard for hackers to launder stolen funds. >> So now let's yeah talk a little bit more about the recovery. You decided to offer a bounty of 5% for voluntarily freezing attacker funds and 5% for voluntary recovery.

Um, and this I think is is sort of similar to what BBE did. What other methods um I don't know if there's any other methods that you've used to try to get the fund other than these public you know requests um to get the funds frozen or recovered and just generally like how did you even come up with the amounts and um you know how do you kind of approach this effort? >> Yeah. Um this this we kind of just followed by bits case. Uh it's uh we did have an internal discussion around like the exact percentage and then uh if for example for those who help us froze

account already do we pay them the bounty as well and we decided yes we will also pay them the bounty. uh unless they they don't accept it then we want to donate the money maybe to some uh third party organ non non- NGO uh non-government or nonprofit or organizations etc. So um other than that it's mainly following by bits case. We did have another group with BB bits uh technology and security team that we want to learn from uh their actions what they did which prove uh helpful. So uh so there were some lessons that we are learning all together.

>> Okay. And um I also wanted to talk about the user protection fund. So you um had $464 million that you could use for those um stolen funds, which is more obviously than what was actually stolen. Um but talk a little bit about you know how you decided to um even you know create one of these funds how you amassed the fund and now that you h have actually experienced something where you've had to use it like is there anything that you would do differently going forward uh when it comes to a fund like that? H well this fund was actually established

just a few months after I joined big that was the last bare market mid 2022 uh when a lot of smaller exchanges were running out of their cash or went bankrupted but it wasn't FTX yet uh but a little bit similar to what we saw earlier this year in June and July that there were three exchanges consecutively just closing down or bankrupt or just simply run away. So in 2022, mid 2022, we decided to set up this big protection fund. And indeed, for the last four and a half or slightly more than four years, we've never really had a chance to use

the protection fund, at least not in such a huge amount. there were smaller amounts used to cover smaller incident or sometimes a little bit of users loss due to instable system or so but it's all very small amount uh but but I'm actually quite glad now that we set up this whole thing and it is in open wallets it was in three different open wallets before the incident right now it's still in three uh but the the amount of protection fund available in here did increase uh I think since yesterday because we started the Bitcoin withdrawal. We we moved some money from

protection fund to our hot wallet in order to deal with the withdrawal uh potentially a lot which is actually smaller than we thought in terms of the withdrawal amount. But right now the big protection fund is valued at about 556 million. We did promise that we will get it back to 300 mil which is a threshold that we we we told the industry about uh about one year after setting up the the protection. Actually the initial threshold was 200 mil but then we increased it to 300 mil um and hence we want to keep it there. So within a week we are going to move our own cap company's capital to this protection

fund and keep it more than 300 mil uh again in open wallets again in mainly bitcoins as the core assets. Would we do something different about this protection fund? I I don't think so. I think it's more about the security infrastructure that we would do differently. protection fund did serve its purpose as a um self-established insurance sort of role and um and this time it's actually uh quite meaningful to especially our users that they know their uh their assets are not affected because we get has this protection fund as a protection.

>> Yeah. So talk a little bit more about what you just said about how if there's anything you would do differently, it's, you know, how you would set up your security system. I'm sure so many crypto teams just from the sheer number of hacks we've seen this year are constantly thinking about that. So you know, what would you do differently for your security system? >> Yeah. So um number one we again this is something we will continue updating the um the the whole community about about security about our incident report through different statements. Uh but if I were to answer this question right now by the way I'm not a security expert uh but I'll do my best to answer this question. Number one, we will uh isolate

a lot of by by the way after the incident, we've already done this sort of isolation like all the relevant servers and systems have been isolated from the network in order to prevent further compromise and uh to preserve evidence for forensic analysis. Uh and at the same time we are resetting all the internal credentials. I myself over the weekend, you know, logged in my my own account a few different times and of course my some of the services that we're using, you know, delete this old one, uh install this this this new one.

So, as a as a whole team, we did a lot of uh credentials, revoke, reissue, you know, render the uh the the credentials obtained by the attackers invalid. And also for us as a as a system the u the highly sensitive system sort of acts have also been also revoked and restructured with multiple approvals now required for critical critical operations. Um so these are the main things that we did for the past uh few days but there are a lot more plans that's coming up which uh I I hope we get another chance that that that we can share and also please understand that

there is a very delicate balance that that in terms of okay we want to share a lot of information with our industry participants with our users uh with our institutional clients for example at the same time we can't share all the information because that actually just exposed ourself too much to other potential threats like now they know the exact structure of your security system and your team member right and all the vendors that that you you use then they can target them more easily so there's a balance that I need to maintain here by sharing enough information but not too much information

Yeah. Yeah, that totally makes sense. So, um I was curious also like if you had advice you would give to other crypto teams about how to handle things like third party services. >> Uh do a lot of checks on the third party. Yeah, this is definitely one thing that we uh we didn't do enough um and and we are going to change that. And another thing is uh right now I think hackers are using a lot of social engineering by the way just after the this incident. Uh there are still people who are um targeting me. they they know that this is the the period of time that

you know I'm I'm talking to a lot of external partners looking for help or just for better communication and there were cases that they pretended to be um from another you know major investment team who approached us and and did some something and and we we almost uh um you know started a real conversation but along the way I did another verification uh with with the person that they try to pretend and realize, okay, this is again scammers. So, >> and do you think that was EPRK again or or just some like a random?

>> I think it could be both. >> Yeah, it could be both. And uh I uh I don't know exactly. So, so we are uh this is still a lot of things that going on but my point is for the current crypto community especially like this is a group of people like we are the group of people that heavily exposed uh when it goes to you know your crypto custody your uh your security you know have a very good habits you know change your password uh frequently something like that like quite basic but please do the basic things very well and then if you are you know an organization like us

who are custoing some of your users fund or a key protocol that has some like earning program you have a v etc. you do have a much more complicated security infrastructure that you should build and you do want to check on every single possibility that you can be exploited and maybe just do another check and do another check. >> Okay. And so one thing I didn't catch that recent one that you think could was another potential hack that happened after this hack like in the last >> it's not a hack. This is a social engineering towards me >> but it happened it happened in the last few days.

>> It happened yesterday. >> Oh wow. Wow. So so they're taking advantage of the fact that you're in this moment of chaos. Yes. >> And they're trying Oh okay. Okay. That's that's really helpful for the industry to know that while you are the victim of a hack and you're trying to um recover from that that they are trying to target you again which makes a lot of sense because it's a moment of having to do a lot of actions kind of quickly. So, so like the sort of slow vetting that might happen is maybe not um it's just yeah, you you just have like you're out of your normal rhythm.

>> Correct. Um, so one other thing is um I wanted to ask like I'm I'm sure every single exchange has protocols in place to you know prevent a hack from North Korea and you know I don't know if you can reveal too much about like I'm sure that you had simulated so many times how you might be targeted by North Korea like like are there any um tips that you would give about how you weren't thinking about that correctly or you know what you would do differently going forward?

>> Uh well, I've I've watched a lot of North Korea targeting cases. So, not this particular incident that we are facing because we will again publish more incident report to tell the public um uh review like all the accurate information. But the general ideas behind a lot of uh North Korean incident target is that um again it it started off very likely as a social engineer like they they know especially the public faces in this industry right like for me they know I do a lot of interviews they know I talk to a lot of external partners they know that after

this incident I might talk to this this and that and or I I may you you know, seek help from this, this, and that. So, they pretend to be those people and um and and just social engineered you. This is why it's called social engineer. It's it's because they know your social status. They and they can uh they can just pretend to be those people. Uh by the way for for this particular case that I was telling you about yesterday they actually formed a team uh because there were a few team members in that investment firm who are famous. So they they made it very real like there are different team members taking different roles and asking us to do different

things or try to offer different helps. Uh but I'm glad that I detected that oh this very much looks a little bit tricky and then checked through another uh channel that I really know the founder or or or the the leader in that organization and and be aware that this is not really she. Um so something like that like social engineering is a is a very important step one that you should hopefully identify if if the um if someone who asks you to do an interview on a strange live stream platform you know if it's not the the Google meet or the zoom that you keep using they give

you another software I think this is highly suspicious by the way Laura because this particular uh VDO ninja website that you guys use. I also like the first bell when I look at this website was like like ding. Um and and then I'm aware that this is slightly less common than maybe Streamyard, but still still common enough. And uh but by the way, something like that, you just want to be very very cautious when you see anything that may not be a norm or may not be or even if it's a norm, you want to double check and uh uh and and when you see something suspicious, be

very very vigilant. >> Okay. I do also have to ask, so now that you have experienced this, how does it make you reflect on how your exchange um has worked to prevent DP DPRK from laundering stolen funds in the past? Like, do you I I you know, I don't know what you can say about how the approach that you took to that and whether or not it's um you know, causing you to make changes going forward. uh how we saw DPRK launderer funds uh number one they break it into very small pieces in terms of you know as small as like 10,000

uh and they use a lot of very small exchanges like there were some exchanges when I look at those DPRK reports and incidents uh they use something like fixed float like a very small exchange that I've never heard. Uh but it's a name that came out a lot and they use a lot of privacy coin like Zcash uh or Montero. >> But I was wondering like on Bitcat like if you I'm sure you have some program for that. But now that you're in this position, are you you know looking at how your exchange does that to to try to do it like in a better way going forward?

uh in terms of how we build our system or in terms of >> to prevent DPRK from using BICAT to launder funds on BAT. >> Oh. Oh, well KYT and because we do have all of our users KYC seed. So Bette and many major exchanges is not uh like their number one choice. Sometimes the very small amount go through us and we help um help them you know phrase the account. Uh but for sure there are things that we can probably even do better. Uh but I think you know have your users KYC and do do enough KYC KYB is probably a good starting point. Uh and hopefully or we

were also discussing the other day that maybe we need a a more alliance sort of setting for this industry at least you know among the top players like the top exchanges, the top security firm uh the top intelligence um regulators or or or or firms that that we can you know hopefully hopefully build a system uh build an alliance that can prevent more stolen funds launder and uh bad behavior activity happening in this industry.

>> Okay, so we're at time, but I do have two more questions if you have a couple minutes to >> Sure. >> to go. Oh, okay. Great. >> So, um there's just something I was so curious about. Um I'm sure you have seen, well, at least I have seen. I don't know if you have seen but in the past there's been memes going around the industry whenever there's I mean it it could be actually any number of things that happened but um it appears to be cryptospecific where they will uh create like a little grid of four Asian female CEOs and make disparaging comments about them. And I saw like similar memes or similar comments um about you. Um these these

are comments saying that like Asian women CEOs are fronts for the real founders and things like that. Like I quoted Zach saying something similar earlier. Um I'm curious like what response you have to people who have been making those comments in the wake of this hack about you >> about me being a female CEO. Well, they they ha they have some theory that like Asian women CEOs are fronts for whoever's the real uh you know power player I guess behind the scenes >> and and they were they were making these comments about you as well. Maybe you didn't notice but >> well yeah

>> well I I have to say I'm not I'm not in I indeed I'm not the founder right the company was started eight years ago. I only joined about four and a half years ago. Uh but I'm I'm CEO and I manage a lot of things. Um as for the accusation of being the face or what I mean if if I can be the face and I can make our company more uh powerful and influential I don't mind them calling me this. And I think the key part is what's the value we are creating or I am creating and uh um and and and delivering to our goal and then uh what are the messages we are

sending to the whole industry. I think those are the key part that I care a lot more rather than you know people calling me face or or flower or whatever. I just don't care about those things. But but they're right. Like I'm not the founder and uh uh and I'm I'm I'm just CEO. >> Oh, okay. Yeah. I I don't know if you fully understand what I was saying. Just like like they're they're almost saying that like just because you're a woman or an Asian woman or something that like you're not the real I didn't mean that you had to be the literal founder, but that you're not the real CEO. I guess >> I mean there are so many uh female Asian

females in all the industries right in crypto. Yes. In even AI uh I I don't think being a Asian female have any issue uh because there are so many Asian females who prove to be very powerful and influential. uh I will I will try to you know continue work my best towards uh delivering better results for for our industry for um for this you know in a crisis like this how we deal with it I just don't think being an Asian female has any thing in terms of this >> okay all right so let's just talk about you know now that you're hopefully

coming out of this incident um I'm curious like Now that you are uh have started withdrawals, are you seeing that they're that you know people are withdrawing more than you expected or are you seeing fewer withdrawals than you expected? >> Yeah. What's your take there? >> Yeah, there are actually fewer withdrawals than I expected. Uh actually today because yesterday we started um the Bitcoin withdraw. Today we started the Ethereum withdrawal. Uh the the Ethereum withdraw started today at UTC 8 a.m. We actually saw a new uh so a net inflow after one hour of that withdrawal open like today the uh the the Ethereum

inflow to big is 9,674 Ethereum with outflow approximately 9,023 Ethereum. uh and that's the data after 1 hour of the withdrawal open. So that's the sort of number we are seeing right now. Um again I really appreciate any users who decided to stay with us and uh hopefully uh for those users who we lost these days we can win them back one day um with our dedication with our good activity uh that we can track them and and hopefully there will also be a lot of misunderstanding cleared. We

actually plan to organize a series of uh for example security oneonone with our key clients and then uh incident report is also part of it like being transparent about what happened about the actions that we are taking. Um just a lot of activities and and and gradually the the whole company is already back to normal business. Uh but we know we needed to do a lot more than before to win our customers back. >> Okay. And um last question. So the exchange uh plans to IPO in three years.

Is that still on? And if so, does the hack change those plans at all? >> Uh I don't think the hack changes any of our major financial plan. Uh yes, we talked about potentially having an IPO in the future. uh it is still on the road map and uh uh and even after the incident we've been very uh commun communicative with law enforcement organizations with different regulators um while whether whether you know certain regulators may uh may feel this is a incident that they don't feel comfortable or so uh I I'll leave it to my legal team to you know clear the air

out. But we we did be be um decide to be very transparent and share those information. And um this is the case that number one we are a victim. Number two we are also um showing the industry that uh that we can handle this very well um by being transparent by being in investigative etc. that we we do think we can become stronger coming back. >> All right. Well, thank you so much, Gracie, for sharing your time during what is I'm sure is very stressful period for you and good luck recovering um hopefully, you know, as much of the funds as possible.

>> Thank you, Laura. >> And thanks everyone for joining us. And later on today, we will have Dex in the City. So, join uh rejoin us later at noon. >> Nothing you hear on Unchained is investment advice. This show is forformational and entertainment purposes only, and my guest and I may hold assets discussed on the show. For more disclosures, visit unchainedcrypto.com.