How a Third-Party Zero-Day Let Hackers Drain $388 Million From Bitget

Transcript

By the way, just after this incident, there are still people who are targeting me. They know that this is the period of time that I'm talking to a lot of external partners, looking for help, or just... for better communication. And there were cases that they pretended to be from another major investment team who approached us and did something. And we almost started a real conversation. But along the way, I did another verification with the person that they try to pretend and realize, okay, this is again, scammers. That happened after this hack? Like in the last few days? This is not a hack.

This is a social engineering towards me. But it happened in the last few days? It happened yesterday. Oh, wow. Hi, everyone. Welcome to Unchained, your no hype resource for all things crypto. I'm your host, Laura Shin. Thanks for joining this live stream. First, we'll take a quick word from the sponsors who make this show possible. This episode is brought to you by 1inch Aqua, the shared liquidity layer from 1inch. Back multiple liquidity positions with one wallet balance. And keep your tokens in your wallet until a swap fills. See how it works at 1inch.com/aqua. Not listening to Bits and Bips yet?

It's our weekly crypto and macro market show with Ram Alwalia, Austin Campbell, and Chris Perkins. Search Bits and Bips and subscribe. Today's guest is Gracie Chen, CEO of BitGet. Welcome, Gracie. Thank you for having me. Always nice to see you, Laura. Yeah, nice to see you. Sorry that it's not better circumstances. BitGet was just the victim of a huge hack for a total of $388 million. This bears a number of hallmarks of hacks by DPRK. Let's go back to the beginning. Tell us about that day. I think you found out in the middle of your night.

So first of all, tell us how Beckett figured out that it was being hacked and how you learned about it. Sure. Yeah, so beginning at 6:31pm UTC on September 24, we saw some unauthorized transfers. Actually 6/31 was the first round of unauthorized withdrawal, and that's very small amount. I think the the attacker or the hackers are actually very smart that they just did some testing transfer 0.48 Ethereum from an ETH hot wallet and the 93 TRX from a TRON hot wallet. Both were below the risk control threshold and did not trigger a system alert. But at 6:58 UTC that day, the attacker initiated 17, starting

from 6:58 actually. So 6:58 is the first timestamp. But basically attackers initiated 17 large transfers across different chains and different assets with a total volume of approximately 361 million that were stolen during that time. Actually, our system figured this out much earlier than I did. Seven minutes after the first large transfer, our platform's reconciliation system detected a significant discrepancy and the risk system automatically blocked all the user-initiated withdrawal platform-wise.

But this didn't really fully stop the bleed because the hackers were very smart that they actually hacked into our internal system using a third party zero day vulnerability. So they exploded this vulnerability to gain access to a critical internal management system and then as an impersonated identity, they then created some fraudulent withdrawal comments and caused the wallet service to execute those transfers. So the attacker just accessed the wallet-related backend servers and directly inserted fraudulent withdrawal comments into the wallet system. Hence,

the wallet system sent out some transfers. And even if the risk system that reacted, that didn't really stop the bleed at that time. But at the same time, another thing that the attacker did is also erasing traces. And that's why it took longer and it become harder for us to identify the root cause. Basically, the hackers, what they did is after completing the transfers, the attacker deleted all the traces that the fraudulent withdrawal comments might have left behind in an attempt to conceal the attack and hinder the root cause identification. So due to the lack of direct evidence, we needed to

examine a broader range of systems to identify the root cause during this incident. For me personally, I just happened to woke up about one hour after their first major transfer. Well, at that time, especially my technology and security team are already in full house, like full steam working on that already. But they also haven't really called me, but I woke up myself. That's a coincidence, but I'm sure even if I didn't wake up, my team might have caught me in about 10 minutes time. So when I woke up, that was my 4:00 AM and I saw some text messages on the

working phone. And I started to, you know, together with our technology team, see what we can do. And I also decided to be on a live very quickly because I figured this is the time that the whole community is speculating because all the things are on chain. People can see there are also external, like voluntary based white hat hat hackers like SEAL911, I know their founder is CZ Sun, and a couple of other voluntary white hat hackers. We've already been in a telegroup for many years because we help each other tracking different funds. There were cases that some fraudulent funds

went to bigot and we helped them first. I saw from that group, like the external community already discussing and asking us. So I wanted to be very upfront answering questions and facing the community directly. Okay. Yeah. I mean, it's really impressive that you got on that live so quickly. And it was sort of reminiscent of when Ben Zhao of Bybit also did something similar. I did want to ask, you know, about the fact that they did the test transactions and also had covered their tracks. Because I asked Taylor Monahan what she would ask you, and

she basically asked why there were these transactions that spanned over what she thought was about three hours. Is that accurate? Yeah, that's accurate. The first large transaction, as mentioned earlier, was 6:58. The last transaction was at 9:23. So that's less than three hours from the first testing transfer. Okay. And so was it because they had covered their tracks that you weren't able to stop that one that happened almost three hours later? I think there are mainly two reasons. The first one is what we discussed

earlier, like finding the roots and do the remediation took longer. But we did one specific important thing that we also did in between the two rounds of their attack is that there were actually technical containment measures that my technology and technical and the security team did. But at that time, we cannot rule out the possibility of a private key compromise. So we again switched on certain buttons and allowed the different wallets to make transfers so that what we did is we collected all the money from the hot and warm wallet. back to

cold wallets. And that gave the hacker another chance of doing attack. But the amount is much smaller. The total value of the second round of attack is... about 30 million and that's from 855 to 923 because we switched on the system again and allowed them to give them another chance. But we needed to do that because there were far more than 30 million on the hot and the warm wallet that we needed to rescue. So there were mainly two rounds and in between there is this important discussion that we needed to make. And there are so many possibilities. So a huge difference between begets heck

and BybitTech is that BybitTech, the root was quite clear, right? It's a safe wallet front end issue that touched their cold wallet. But our issue is very different. It's hot and warm wallet. And it seems like it can have a lot of different causes. And that's indeed why it made it much harder to identify the root cause because it involves a lot of systems and a lot of different public chains. And then what can you tell us more about the third party system that was hacked and how that transpired? I can't disclose the third party name nor the exact vulnerability. It is

a security product that we used to hopefully make it more secure. But the vulnerability is a zero-day vulnerability. It means it's never discovered before. But the key thing here is I don't want to blame external party. We are taking the full responsibility and we are going to publish an incident report very soon, probably today or tomorrow, but definitely within a week that can give you more details and give the community more details on the, you know, the this this vulnerability itself. I think in general, we've also we've already notified the vendors about their vulnerability. There are a lot of things that we

are doing together and this is still an ongoing incident. Other than the hack itself, right now I think the way as a team are looking a lot about number one, business and operation wise, how can we win our users back? get all the business as usual, and then at the same time, watch and trace all the hackers activity around the money laundering. We actually worked together with a lot of different decentralized protocols, I know you guys covered this yesterday, there were protocols that refused my request of phrasing certain addresses, not serving the hacker. There are also other DeFi protocols that

came out and said, "Oh, we helped you froze your accounts and we are not interested in the bounty because we want to get to recover more." Right now I see a lot of different faces, although they are all doing DeFi protocols. And as a community or as an industry participants, I really appreciate whoever at this stage are helping us, you know, avoid, free some of our stolen funds and then not allowing the hackers to easily launder the money. Okay. And out of curiosity, was the third party vendor one that is familiar with the threat level for crypto companies? Like, was it a

security company that, you know, also understands kind of just that there's a heightened level of security needed for crypto companies? Or were they more a general provider? They are slightly more general provider. I would say if you are not a crypto company, you might have used their service as well. But again, I think this part is easier if we leave it to the incident report to answer more thorough questions rather than me disclosing too much. Okay. Well, one last question that I have to ask is whether or not social engineering was involved? I can't answer that either. But I can assure you that if it's Lazarus, they use social engineering a lot. And

social engineering is a common threat targeting the whole industry. But for this incident, exactly, I can't answer that question. I'm sorry. Okay. Okay. Because obviously after Drift, that's... What's on everybody's mind and that one was was so chilling. But I totally understand if you want to wait until you have your fully polished explanation to release. All right. So we're going to go into more details around, you know, which assets were affected and which chains and what happened to the attempt to recover those funds. But first, we're going to take a quick word from the sponsors who make this show possible.

$540 million. That's how much concentrated liquidity sat idle in a given week in the first half of this year. About 30% of the DeFi TVL, if you're wondering. That's according to DUNE research commissioned by 1inch. But there's a solution. 1inch Aqua is the new shared liquidity platform. It lets LPs back multiple positions with the same token balance and keep their tokens in their wallet till a swap comes. Why does that help? Because the LPs don't have to split their tokens across positions. They can cover more market conditions and pairs with their full balance. That means more activity across deeper liquidity. See how it works at 1inch.com/aqua. Remember that providing liquidity carries risk, and fees aren't guaranteed. If you like this show, there's another one from our network you should

be listening to. Bits and Bips is our twice-weekly market show. On Mondays, Ram Alwalia, Austin Campbell, and Chris Perkins chat about where crypto and macro collide. It's sharp, it's fast, and it has its own channel. Search Bits, plus sign Bips, and subscribe. Back to my conversation with Gracie. So as you mentioned earlier, there were a number of affected chains, Ethereum, XRP, Arbitrum, Avalanche, Optimism, BSC, Base, Zcash. And I noticed that Zcash was actually listed a day later maybe or something. And I just wondered why it was not noticed initially. I think there

were two public chains actually is the Zcash and TIA or Zcash and Tron. There were Zcash and another public chain that we later on discovered that that's also involved in or affected in this incident because it's a relatively smaller assets and public chain used at our platform so that wasn't on the first round of detection it wasn't really because Zcash is Zcash and Zcash as a privacy coin do have very different features than many other cryptocurrencies but it's mainly because it's a smaller chain Okay, okay. Yeah, I just was curious about that. So I then also wanted to ask, so I'm

sure that the exchange has protocols in place for situations like this. You kind of mentioned, you know, earlier the move to transfer a large portion of the funds in the hot wallet and the warm wallet to the cold wallet. So I was curious, like, if you had any other, you know, you know, insight you could give us into what the plan is, because obviously the pause on withdrawals, I think happened later. And I wondered kind of why that wasn't, you know, put in place earlier. The part of the withdrawal actually was automatically switched on at 7:05, the power wasted seven minutes after

the first large initial transfer. So we've already like the whole risk system already automatically blocked the user initiated withdrawal. But the part that you were asking in terms of like us, naming it as a withdrawal pause is slightly later because actually at that time, whether we stop withdrawal or not doesn't really make the difference in terms because the user, sorry, the hacker is not doing a normal user withdrawal. Hopefully that answers your question. Later on, it's

more of just users cannot even do the withdrawal button. And for us, the withdrawal paused slightly earlier at 7:05 when the system detected this significant discrepancy. Okay. But then I don't understand how they were able to do the subsequent transactions? Because this is not normal user withdrawal. It's at the back-end server withdrawal. I see. They were just using a totally different mechanism. Okay. Okay. All right. So let's now talk about your attempt to recover these funds, because obviously I did see that you reached out to a number

of different foundations across these affected chains. Some of them had frozen the hackers' wallets. And I wondered if you... You know, because there's a lot of discussion on the timeline about which chains can do what. And so, you know, from your discussions with them, I don't know if you could help illuminate what determines whether or not a foundation can freeze wallets or not. I don't have much information, but I don't have the first hand expertise on this. I do have another team member, actually a few team members who are more hands on in terms of understanding the mechanism of this public chain and that public chain. But I want to highlight so far there are a few organizations who are been very helpful tether

circle these two stablecoin issuers at the uh first two batches of um organizations who help us throw some stablecoin on on the uh that that's from our stolen funds and then yesterday near intent also helped us froze another uh i think it was 500K-ish sort of different crypto that went through the NEAR protocol, not the direct NEAR protocol, but the NEAR intent sort of swap, or a swap, I think. But basically, these three right now are the main sources of organizations that help us froze the some

accounts and some addresses. But I think the recovery is just another story. Recovery is different from phrasing. Phrasing is slightly easier. Recovery, we need to go through a lot more, especially legal procedure, which we are doing our best. But again, I don't think that's a huge source of funds that we are looking at to get back For example, if you look at Bybit's hack, after one year, Bybit's stolen fund of more than 1.4 billion, there were only 3.5% that's frozen. And then the part that they got to recover, it's much smaller.

I just hope that this time we can do better than 3.5%. But I don't have much hope, honestly. Okay. Okay. Yeah. I mean, I would imagine, so what happened last time was that with Arbitrum, they were actually able to freeze 71 million, but that involves getting the Arbitrum Security Council involved. And with Circle and Tether, because they're apps, you know, on these chains rather than chains themselves, it's just a much easier, quicker decision. But I did want to ask about you know, circle because they were criticized in the past repeatedly. But especially I feel like for the drift hack for not

acting and instead allowing the stolen funds to move freely. And obviously, you know, this time around, it was a much smaller amount that they were able to help out with. But why do you think that they or I don't know if you have any insight into why they moved to help at all, because that was sort of new for them. Well, I didn't follow the drift case in terms of USDT or USDC or Circles action that closely. So I don't know the details in terms of how the drift case is different from ours. All I can tell you is Circle actually moved quite fast in this situation. I don't know if it's because they decided to change some protocol or rules or

maybe it's because the case are different we published all the information very very quickly right we uh we published a dashboard that follows all the stolen funds addresses and it's still alive we'll keep it alive a long time by bits lazarus they have a lazarus bounty website that they created right after their hack. Right now, if you go to that website, the first page dashboard is still obviously ours. So maybe as an industry, we all evolved. But again, I don't have the details on the drift case, so it's hard for me to tell you why this time is different. Okay, okay. Yeah. Well, yeah, it's definitely noticeably different because we actually did a

whole episode on how they did not act at all for $280 million or something like that. So, yeah, I was surprised to see that this time. There's another actor who appears to have changed his stance during this incident, and that's Zach XBT. Earlier this year, he tweeted, about, I mean, there were a number of these, but he tweeted about some pump and dump activity that he saw that he felt originated on BitCat, also on Gaten Finance. He tweeted, "Shawn Liu is the BitCat big boss who allows these scams to operate behind the scenes while Gracie Chen is only the face of it. The Chinese sex cartel has gone unchallenged for years and doesn't care as long as they benefit from the activity.

And then he said, I think it's almost time to increase public attacks against BitGap. And later he tweeted about a token, a lab token, which he called a market manipulation scheme via spot. And he was saying that he thought 95% of the supply was held by insiders. And again, during that, he was calling out BitGap because I guess he traced that a number of the insiders had withdrawn almost $500 million from BitGap. So last week after news of the BitGet hack went out, he initially tweeted, "I have no current plans to monitor the BitGet exploit by DPRK. I stopped wasting my time on helping people in the industry who are not supporters of my work, donors, clients, long-time followers, etc. So it sort of seemed he was like throwing shade

on your exchange. But then on Monday, he tweeted that he saw Chinese illicit actors trying to launder funds for DPRK from the Biket Hock asking for help in Discord. He identified five aliases that were being used. He, you know, noted he... reveal the transactions that were tied to those aliases. So I was curious, like, what happened in between the initial announcement that he wasn't going to work on this and then, you know, the time when he actually noted where some of the funds had gone? I don't know. You should ask Zach this question. We did talk to him and among many other on-chain researchers, volunteers, like those white hat hackers that I told you about in some

formal companies such as Slow Mist and Mandiant that we formally engaged and they are helping us independently research and come up with incident report. So our team, actually I didn't talk to Zach directly, but we do have a dedicated team that consists of technology team, blockchain expert from our team, listing team who know a lot of people in this industry that they are working together to talk to on-chain researchers. I don't think we formally sort of like pair paid Zack a retention fee to start investigation, nothing like that. So maybe he is just looking at the so-called Chinese

elicit actors laundering money and that he find it hilarious. I actually saw that post when I saw the Discord post I also find it quite hilarious. Like you saw someone said, you chose the wrong job pal. And then made a fun comment on Zach's Twitter post saying, yes, indeed, they chose the wrong job. But other than that, we're not like formally engaging Zach, but I do appreciate him and and anyone right now in this industry who cares and who are working together to make it very hard for the hackers to launder

our stolen funds. And do you have response to his allegations from a few months ago where he felt like these pump and dump schemes were either originating on your exchange, but then also some of the teams were cashing out from your exchange? Well, all these cryptocurrencies, if you look at many of the names that he specified, they are all listed on many exchanges. They are typically also listed on Binance and, you know, Gate, Biget, Bybit, OK, like all the top exchanges sort of have listed this token. So I can't really respond to him saying, you know, pump and dump only happened at Biget because it's

available on many exchanges. And then maybe we can discuss further in another chance after I get a chance to look at the specific pump and dump activity that he is referring to. But right now I don't have a response on that. Okay. And from his identification of those aliases in the transactions, did that enable you to either get some of the funds frozen or even recovered? For this one particularly, I don't know, because this post that he tweeted was only yesterday. And I have a team who are covering this, which they haven't told me specifically about yet. whether this particular information is helpful or not. I know the near intent

thing because they updated me that it's quite useful and they are approaching like my team is approaching near intent. They have a teacher group set up already. They are discussing the exact procedure we should take from our legal end in order to hopefully recover those funds. So those are they are some something that I'm updated, hence I know. For the Zach part, I am not updated, so I don't know yet. Okay. So, yeah. Well, actually, why don't we talk more about beer and tents? So this is going to be a setup for kind of a contrast that we're seeing from different teams in the industry to this

hack. So go ahead and talk about what it is that NeurIntense did that was so helpful for you. Yeah, well, near intent, first of all, I also just learned like shell system through this article that the near intent CEO just wrote. Alex, he talked about how near intents as like they build this shell thing that's basically a race intelligence layer protecting near intent and also protecting NEAR in a way that basically it automatically detects any deviations in flows and collect a

lot of inputs from KYT, your transaction, and providers and different researchers. Then based on all these signals, the protocol can decide whether they want to allow a particular transaction to happen or not. So their stance that is permissionless doesn't mean neutral, that they should basically refuse to help launder stolen assets is a key point or a key stance that they are making, which in my opinion is, of course, I really thank them for that because as

I pointed out earlier, to another DeFi protocol that will publish all this data on the dashboard. Those are obviously laundering flows and stolen funds, and we hope the protocols can react to them. But whether they can or not is a technical problem. It may also be a governance problem. And each individual DeFi protocol works very differently. That is totally like a new world that I'm not that familiar with. I know some high level concepts, but for the exact protocols, we just want to appreciate anyone that in this case say something like, okay, permissionless doesn't mean neutral,

because I do think that should be the case. If it's so easy for those hackers to launder their money, obviously there will be more hackers and there will be more hacks towards the major players in this industry or even small projects, right? Like along this few years that I'm in this industry, I've seen a lot of hacks towards big ones, towards smaller ones. In total, hackers are one of the largest enemies of this industry, and we should all stand together to fight them rather than allowing them easily to launder stolen funds. Yeah so now let's also talk about ThorChain as a contrast and then we can kind of tie this

together because you publicly asked ThorChain not to service the addresses that were associated with the hack because there was laundering that was flowing through there and I have been seeing some conflicting takes around how much control they have to block these transactions there's a lot of ThorChain stans who are saying that they, you know, it's permissionless, blah, blah, blah. But as far as I understand, I think they have an admin key. So, you know, what's your, like, when you made the request, what was your understanding about their capabilities to, you know, potentially block the laundering of the stolen funds? My, okay, so that at that time, I don't think I I know exactly how their governance work, neither do I

know it now. The key thing is it's quite clear that, again, those are public information that we listed and keep track. And hence, I just decided to formally ask them to refuse services to the addresses. Of course, by asking them, it could be their team members if they are very much like there's a core relationship foundation, or it could be the nodes and the swaps on that public chain or so. Of course, later on, I also did more research. I realized, yes, there were cases that they shut down the system because of some other hacks, especially some hacks that

they themselves were a victim. But in general, it's not something I want to just targeting ThorneChain by saying, "Oh, you should change your protocol from permissionless to be something else." I think what Near Intents did was quite interesting that as a solution, although the publishing still is, permissionless, but you can build a layer on that to do more KYT, to avoid the hackers found, something like that. Yes, I did see a lot of different even there are some major industry leaders who are even our competitors, right? Like they came out and

accused Thornchain for being not standardized their standard like when it's them being the victim, okay, they can shut down the system and when it's not them, it's us, they just refused it. I saw the Thornchain official tweet to refuse use my request. But over the weekend, I still had a lot of things to do, like more than 100 things on my list. So speaking to foreign chain wasn't a major one. But I did Later on reached out to them through third party privately and I wanted to you know Hopefully schedule a meeting with them to understand how their protocols work and what we can

potentially do together I also made this as a as a shout out or call out yesterday at another podcast Said you know, Thorn Chan I want to talk to you and and that's let's sit down and discuss. I But other than that, I don't have a lead now with Stonechain. And there are still a lot of funds that we can chase after and my teams that are working around. But have you felt like when you had the private conversation, did you find that they were amenable to helping you in any way? No, I haven't. I haven't had a private conversation.

I reached out to them through some third party people, but nobody gave me a firm lead to their core developer yet. I see. Okay. Well, so now that you're in this situation and you're seeing this whole discussion kind of around like what different actors in the industry should do in an incident like this, like, I mean, you started to expound on that earlier, but I don't know if you have further thoughts on, you know, you know, what types of organizations should move to act, like when the principles of decentralization and permissionless, permissionlessness should, you know, be prioritized.

Like how do you think about this now that you are in this situation? Well, last year when I was looking at Bybit's situation, I was quite surprised that as an industry, we can't stop the bad behaviors or the hackers laundering their money. Now I'm experiencing it, but still there are some parts of it that I don't get why. So back to your question, I would first call out to public chains and protocols that they should not, hopefully that they do not need to choose between being open

and excluding hackers. And for us, all we can do is, you know, and then for those who can phrase some of our frozen accounts that we want to follow the appropriate legal and recovery procedure so that like the near intent pointed out they needed us to do that so that hopefully they can recover the funds for us. So that's exactly what we're doing. But more collaborations. I know there were a few team members of mine who are on this specific project of chasing after the Luzon Fund. They have been engaged in many groups. They gave me like

a daily update-ish. But so far we are not seeing a lot of progress. If you look at Biget's, actually let's take a look now. We have a dashboard of tracing all these funds, which is called trace.bgblockchain.xyz. But if we look at the frozen amount right now, out of the total stolen amount of $388 million, there are only $632K that's frozen. And again, three major organizations that help us for some account are Nearing, Tense, Tether and Circle. I do hope that there are

more names that I can share with you. And hopefully, again, as an industry, we can make it very hard for hackers to launder stolen funds. So now let's talk a little bit more about the recovery. You decided to offer a bounty of 5% for voluntarily freezing attacker funds and 5% for voluntary recovery. And this, I think, is sort of similar to what Bybit did. What other methods, I don't know if there's any other methods that you've used to try to get the funds, other than these public requests, to get the funds frozen or recovered?

And just generally, like, how did you even come up with the amounts? And, you know, how do you kind of approach this effort? Yeah, this week kind of just followed the Bybit's case. We did have an internal discussion around the exact percentage and then if for example, for those who help us froze the account already, do we pay them the bounty as well? And we decided, yes, we will also pay them the bounty unless they don't accept it. Then we want to donate the money maybe to some third party or non NGO non-government or nonprofit organizations, etc.

So other than that, it's mainly following Bybit's case. We did have another group with Bybit's technology and security team that we want to learn from their actions, what they did, which proved helpful. So there were some lessons that we are learning all together. Okay. And I also wanted to talk about the user protection funds. So you had $464 million that you could use for those stolen funds, which is more obviously than what was actually stolen. But talk a little bit

about, you know, how you decided to even, you know, create one of these funds, how you amassed the fund. And now that you have actually experienced something where you've had to use it, like, is there anything that you would do differently going forward when it comes to a fund like that? Well, this fund was actually established just a few months after I joined Big Ed. That was the last fair market meet 2022 when a lot of smaller exchanges were running out of their cash or went bankrupt. It wasn't FTX yet. But a little bit similar to what we saw earlier this year in June, July, that there were three exchanges consecutively just closing down or bankrupt or just

simply run away. So in 2022, mid 2022, we decided to set up this big protection fund. And indeed, for the last four and a half or slightly more than four years, we we've never really had a chance to use the protection fund, at least not in such a huge amount. There were smaller amounts used to cover smaller incidents or sometimes a little bit of users loss due to instable system or so, but it's all very small amounts. I'm actually quite glad now that we set up this whole thing and it is in open wallets. It was in three different open wallets before the incident. Right now it's still in three. But the amount of protection fund available in here did increase.

I think since yesterday, because we started the Bitcoin withdrawal, we moved some money from protection fund to our hot wallet in order to deal with the withdrawal potentially a lot, which is actually smaller than we thought in terms of the withdrawal amount. But right now the Big Ed protection fund is valued at about $556 million. We did promise that we will get it back to $300 million, which is a threshold that we told the industry about. about one year after setting up the protection fund. Actually, the initial threshold was 200 mil, but then we increased it to 300 mil, and hence we want to keep

it there. So within a week, we are going to move our own company's capital to this protection fund and keep it more than 300 mil. Again, in open wallets, again, mainly Bitcoins as the core assets. Would we do something different about this protection fund I don't think so. I think it's more about the security infrastructure that we would do differently. Protection Fund did serve its purpose as a self-established insurance sort of role. And this time it's actually quite meaningful to especially our users that they know their assets are not affected because FIGET has this protection fund as a protection.

Yeah, so talk a little bit more about what you just said about how if there's anything you would do differently, it's, you know, how you would set up your security system. I'm sure so many crypto teams, just from the sheer number of hacks we've seen this year are constantly thinking about that. So, you know, what would you do differently for your security system? Yeah. So number one, again, this is something we will continue updating the whole community about security, about our incident report through different statements. But if I were to answer this question right now, by the way, I'm not a security expert, but I'll do my best to answer this question. Number one, we will isolate a lot of, by

the way, after the incident, we've already done this sort of isolation, like all the relevant servers and systems have been isolated from the network in order to prevent further compromise and to preserve evidence for forensic analysis. And at the same time, we are resetting all the internal credentials. I myself over the weekend logged in my own accounts a few different times. And of course, some of the services that we're using, delete this old one. install this new one. So as a whole team, we did a lot of credentials revoke, reissue, render the credentials obtained by the attackers

invalid. And also for us as a system, the highly sensitive system sort of acts have also been being also revoked and restructured with multiple approvals now required for critical operations. So these are the main things that we did for the past few days. But there are a lot more plans that's coming up, which I hope we'll get another chance that we can share. And also, please understand that there is a very delicate balance that in terms of, okay, we want to share a lot of information with our industry participants, with our users, with our institutional clients,

for example. At the same time, we can't share all the information because that actually just exposed ourselves too much to other potential threats. Now they know the exact structure of your security system and your team member and all the vendors that you use, then they can target them more easily. There's a balance that I need to maintain here by sharing enough information but not too much information. Yeah, yeah, that totally makes sense. So I was curious also, like if you had advice you would give to other crypto teams about how to handle things like third party services? Do a lot of checks on the third

party. Yeah, this is definitely one thing that we didn't do enough and we are going to change that. And another thing is right now, I think hackers are using a lot of social engineering. By the way, just after this incident, there are still people who are targeting me, they know that this is the period of time that I'm talking to a lot of external partners looking for help or just for better communication. And there were cases that they pretended to be from another major investment team who approached us and did something. And we almost started a real conversation. But along the way,

I did another verification with the person that they try to pretend and realize, okay, this is again scammers. So a lot of the trajectory. And do you think that was EPRK again or just some like a random? I think it could be both. Yeah, it could be both. And I don't know exactly. So this is still a lot of things that going on. But my point is for the current crypto community, especially like this is a group of people like we are the group of people that heavily exposed when it goes to your crypto custody, your security,

have very good habits, change your password frequently, something like that, quite basic. please do the basic things very well. And then if you are an organization like us who are custodying some of your users fund or a key protocol that has some like earning program, you have a vault, et cetera, you do have a much more complicated security infrastructure that you should build. And you do want to check every single possibility that you can be exploited and maybe just do another check and do another check. Okay. And so one thing I didn't catch that recent one that you think was another potential hack that happened after this hack, like in the last. This is not a hack. This is a social

engineering towards me. But it happened. It happened in the last few days. It happened yesterday. Oh, wow. Wow. So they're taking advantage of the fact that you're in this moment of chaos. Yes. Oh, okay. Okay. That's really helpful for the industry to know that while you are the victim of a hack and you're trying to recover from that, that they are trying to target you again, which makes a lot of sense because it's a moment of having to do a lot of actions kind of quickly. So, so like the sort of slow vetting that might happen is maybe not. It's just, yeah, you, you just have like, you're out of your normal rhythm. Correct. So one other thing is I wanted to ask,

like, I'm sure every single exchange has protocols in place to prevent a hack from North Korea. And I don't know if you can reveal too much about, like, I'm sure that you had simulated so many times how you might be targeted by North Korea. Like, are there any tips that you would give about how you weren't thinking about that correctly or, you know, what you would do differently going forward? Well, I've watched a lot of North Korea targeting cases. So not this particular incident that we are facing because we will again publish more incident report to tell the public review like all the accurate information.

But the general ideas behind a lot of North Korean incident target is that again, it started off very likely as a social engineer. Like they know, especially the public faces in this industry, right? Like for me, they know I do it a lot of interviews, they know I talk to a lot of external partners, they know that after this incident, I might talk to this, this and that, or I may seek help from this, this and that. So they pretend to be those people and just social engineer you. Why it's called social engineer? It's because they know your social status and they can just pretend to be those people.

By the way, for this particular case that I was telling you about yesterday, they actually formed a team because there were a few team members in that investment firm who are famous. So they made it very real, like there are different team members taking different roles and asking us to do different things or try to offer different helps. But I'm glad that I detected that opportunity. oh, this very much looks a little bit tricky and then checked through another channel that I really know the founder or the leader in that organization and be aware that this is not really she. So something like that, like social engineering is a

very important step one that you should hopefully identify. If someone who asks you to do an interview on a strange live stream platform, you know, if it's not the Google Meet or the Zoom that you keep using, they give you another software. I think this is highly suspicious. By the way, Laura, because this particular VDO Ninja website that you guys use, I also like the first bell when I look at this website, I was like, like, ding, ding. And then I'm aware that this is slightly less common than maybe stremia, but still common enough. But by the way, something like that, you just want to be very, very cautious

when you see anything that may not be a norm or it may not be, or even if it's a norm, you want to double check. And when you see something suspicious, be very, very vigilant. Okay, I do also have to ask, so now that you have experienced this, how does it make you reflect on how your exchange has worked to prevent DPRK from laundering stolen funds in the past? Like, do you, you know, I don't know what you can say about the approach that you took to that and whether or not it's, you know, causing you to make changes going forward. How we saw DPRK launder

funds, number one, they break it into very small pieces in terms of as small as like 10,000 and they use a lot of very small exchanges. There were some exchanges when I look at those DPRK reports and incidents, They use something like Fixed Float, like a very small exchange that I've never heard. But it's a name that came out a lot. And they use a lot of privacy coin like Zcash or Montero. But I was wondering, like on BitGet, like if you, I'm sure you have some program for that. But now that you're in this position, are you, you know, looking at how your exchange does that to try to do

it? like in a better way going forward? In terms of how we build our system or in terms of how we... To prevent DPRK from using BitGet to launder funds on BitGet. Oh, well, KYT, KYT and because we do have all of our users KYC'd. So BigGet and many major exchanges is not like their number one choice. Sometimes the very small amount go through us and we help help them phrase the account. But for sure, there are things that we can probably even do better. But I think, have your users KYC'd and do enough KYC, KYT, KYB is probably a good starting point. And hopefully,

we were also discussing the other day that maybe we need a more alliance sort of setting for this industry. at least among the top players, like the top exchanges, the top security firm, the top intelligence regulators or firms that we can hopefully build a system, build an alliance that can prevent more stolen funds, launder and bad behavior activity happening in this industry. Okay, so we're at time, but I do have two more questions if you have a couple minutes to go.

Okay, great. So there's just something I was so curious about. I'm sure you have seen, well, at least I have seen, I don't know if you have seen, but in the past, there's been memes going around the industry whenever there's, I mean, it could be actually any number of things that happen, but it appears to be crypto specific where They will create like a little grid of four Asian female CEOs and make disparaging comments about them. And I saw like similar memes or similar comments about you. These are comments saying that like Asian women CEOs are fronts for the real founders and things like that. Like I quoted Zach saying something similar earlier. I'm curious what response you have to people who have

been making those comments in the wake of this hack about you. About me being a female CEO? Well, they have some theory that Asian women CEOs are fronts for whoever's the real power player, I guess, behind the scenes. And they were making these comments about you as well. Maybe you didn't notice, but... I have to say I'm not, I'm not, I indeed, I'm not the founder, right? The company was started eight years ago. I only joined about four and a half years ago. Uh, but I'm, I'm CEO and I manage a lot of things. Um, as for the accusation of being the face or what, I mean, if, if I can be the face and I

can make our company more, uh, powerful and influential, I don't mind them calling me this. And I think the key part is what's the value we are creating or I am creating and delivering to our goal. And then what are the messages we are sending to clients? the whole industry. I think those are the key part that I care a lot more rather than people calling me face or flower or whatever. I just don't care about those things. But they're right. I'm not the founder and I'm just CEO. Okay. Yeah. I don't know if you fully understand what I was saying. Just like they're They're almost saying that like, just because

you're a woman or an Asian woman or something, like you're not the real, I didn't mean that you had to be the literal founder, but that you're not a real CEO, I guess. I mean, there are so many female, Asian females in all the industries, right? In crypto, yes. In even AI. I don't think being an Asian female is, have any issue because there are so many Asian females who prove to be very powerful and influential. I will try to continue to work my best towards delivering better results for our industry, for this, you know, in a crisis like this, how we deal

with it. I just don't think being an Asian female has anything in terms of this. Okay. All right. So let's just talk about, you know, now that you're hopefully coming out of this incident, I'm curious, like now that you are, have started withdrawals, are you seeing that they're that, you know, people are withdrawing more than you expected? Or are you seeing fewer withdrawals than you expected? Yeah, what's your take there? Yeah, there are actually fewer withdrawals than I expected. Actually, today, because yesterday we started the Bitcoin withdrawal. Today we started the Ethereum withdrawal. The Ethereum withdrawal started today at

UTC 8:00 AM. We actually saw a new, saw a net inflow after one hour of that withdrawal open. Like today the Ethereum inflow to Big Ed is 9,674 Ethereum, with outflow approximately 9,023 Ethereum. And that's the data after one hour of the withdrawal open. So that's the sort of number we are seeing right now. Again, I really appreciate any users who decided to stay with us and hopefully for those users who we lost these days, we can bring them back one day with our dedication,

with our good activity that we can track them and hopefully there will also be a lot of misunderstanding cleared. We actually plan to organize a series of for example, security 101 with our key clients. And then incident report is also part of it, like being transparent about what happened, about the actions that we are taking, just a lot of activities. And gradually the whole company is already back to normal business. But we know we needed to do a lot more than before to win our customers back.

Okay. And last question. So the exchange plans to IPO in three years, is that still on? And if so, does the hack change those plans at all? I don't think the hack changes any of our major financial plan. Yes, we talked about potentially having an IPO in the future. It is still on the roadmap. And even after the incident, we've been very communicative with law enforcement organizations, with different regulators. whether certain regulators may feel this is an incident that they don't feel comfortable or so. I'll leave

it to my legal team to clear the air out. But we did decide to be very transparent and share those information. This is the case that number one, we are a victim. Number two, we are also showing the industry that we can handle this very well by being transparent, by being investigative, etc. That we do think we can become stronger coming back. All right. Well, thank you so much, Gracie, for sharing your time during what is I'm sure is very stressful period

for you. And good luck recovering, hopefully, you know, as much of the funds as possible. Thank you, Laura. And thanks, everyone, for joining us. The thing you hear on Unchained is investment advice. This show is for informational and entertainment purposes only. And my guest and I may hold assets discussed on the show. For more disclosures, visit unchainedcrypto.com.

so