Photo: Harris de Weerd, CC BY-SA 4.0 via Wikimedia Commons
Attackers pulled about $388 million out of Bitget on September 24th, and Gracy Chen, CEO of Bitget, told Scott Melker on The Wolf Of All Streets that the exchange covered every dollar from its own capital.
When FTX failed, its customers' money had been mixed with the company's own. Gracy said no user funds were misused at Bitget, and the company decided within the first few hours to make every customer whole.
"We also made a decision that... we will make all the users whole. We as a company will bear all the financial impact of this incident."
Gracy set up the user-protection fund that paid for it in 2022, during the Luna, Celsius and Three Arrows Capital collapses and before FTX failed. She went on a public livestream about three hours into the attack.
The full interview is covered here so you can skip it. 37 minutes of audio, 8 minutes of reading.
Here are the 8 takeaways that matter.
The Wolf Of All Streets · Oct 24, 2026 · 37m · 29m saved
With Gracy Chen, CEO of Bitget
Key Takeaways
The attack began at 2:30 a.m. in Gracy's GMT+8 time zone, a time she thinks the hackers picked on purpose
Private keys and cold wallets were never touched; attackers used credentials taken through a zero-day flaw in a third-party security product
Any vendor with privileged access is part of an exchange's security, not someone else's problem
Bitget paid restitution from its own capital and refilled its protection fund to $300M within a week
A proof-of-reserve published after the hack showed 131% coverage of user funds
The laundering pattern looks like the Lazarus Group's, but there is no formal attribution
Maybe $10M of the $388M has been frozen so far
Non-crypto assets briefly reached almost 40% of Bitget's trading volume, led by tokenized commodities and US stock perpetual futures
Bitget is building a small US team and pursuing licenses to launch there next year
1. Hackers Hit at 2:30 a.m.
The incident started at 18:30 UTC on September 24th, which was the middle of the night for Bitget's Asia-based executives.
Gracy suspects the attackers timed the theft for when Bitget's leadership would be asleep
"The incident started at UTC time, September 24th, 6:30 p.m. ... in my GMT+8 time zone, that's actually 2:30 a.m. ... I think the hackers chose a time like that." — Gracy Chen
Automated systems flagged the unauthorized transfers and froze withdrawals before any person stepped in. Gracy woke about an hour after the first suspicious withdrawal. She began a public livestream about three hours in and shared details as they were confirmed, including early word that private keys and cold wallets were safe.
Within those first few hours, Bitget also committed to covering every user loss from company capital. The rest of the interview explained how it could afford to.
