Latest / The Starting Block / Bitget CEO Gracy Chen Breaks Down $388M Hack

Transcript

Bitget CEO Gracy Chen Breaks Down $388M Hack · The Starting Block

0:08
Welcome back to The Starting Block.
0:09
Happy Monday to you wherever you are
0:11
around the world.
0:12
Welcome back another edition of the
0:14
show. If this is the first time
0:15
joining us, my name is Gareth
0:16
Jenkinson. I'm the head of
0:17
multimedia here at The
0:19
Block and the host of The Starting
0:21
block, our daily show that we've
0:23
been broadcasting for the last three
0:24
months already. It's crazy to think
0:26
we've already been on air for three
0:28
months. If you are joining us and
0:29
you're wondering, things look a
0:30
little bit different today.
0:31
We are broadcasting on Riverside.
0:33
We had some issues with our usual
0:34
studio, But nevertheless.
0:36
It doesn't change the programming,
0:38
it doesn't the big conversation that
0:40
we're gonna be having today.
0:42
Big news late last week,
0:44
BitGet suffered a major hack
0:46
and CEO Gracie Chen has been
0:48
graceful enough to join
0:50
us for a chat this afternoon to
0:52
unpack everything that's happened
0:54
since then and what happened with
0:55
the incident itself.
0:56
So first things first, Gracie,
0:57
welcome back to the show.
0:58
You were with us a couple of months
0:59
ago, this time a little bit more
1:01
stress involved.
1:03
First things first. Hello, how are
1:04
you doing?
1:05
Good, thank you.
1:07
The incident happened on Friday.
1:09
So over the weekend, I obviously
1:10
didn't have much sleep.
1:12
Other than that, I don't think we
1:14
have any major issue now,
1:16
especially given a couple of hours
1:18
ago, we started to allow our users
1:20
to become withdrawal.
1:22
It went very smooth.
1:24
There were, I think
1:26
the, I didn't even have the
1:28
newest number, but around
1:30
one hour after.
1:32
Okay. Okay. Alright. The withdrawal
1:33
started, there were
1:38
7,000 plus orders
1:40
withdrawn successfully,
1:43
and that involved more than 3,000
1:45
bitcoins.
1:46
Again, that went very smooth,
1:48
nobody is lagged,
1:51
and I'm glad
1:52
that this is the
1:55
recovery phase of our
1:57
crisis.
1:59
Yeah, sure, I think it always puts
2:00
users at ease once an exchange
2:02
comes back online and begins
2:04
processing deposits and
2:06
withdrawals. And I think, it's a
2:07
natural reaction for a lot of people
2:08
to withdraw funds once something
2:10
like this has happened.
2:12
Gracie, I wanna take you back to
2:13
last week.
2:14
If you can talk to us a little bit
2:15
about the incident itself,
2:17
how things played out on the day,
2:20
what first brought it to your
2:21
attention that something was going
2:23
wrong? And maybe you can talk a
2:24
little bit about the incident itself
2:26
and how the attackers managed to
2:28
gain access to your systems and
2:29
withdraw these funds.
2:31
Okay, sure.
2:32
Yeah. So for those who
2:34
just joined this, this
2:37
session, without knowing
2:39
anything about bigot incident,
2:41
let me do a full recap.
2:43
Beginning at 631pm
2:46
UTC on September
2:48
24, 2026,
2:52
there were some unauthorized
2:53
transfers that involve certain
2:55
assets that were made across
2:57
multiple blockchains from Bigot's
2:59
HOT and warm wallet
3:01
infrastructure.
3:02
So far, our investigation
3:04
has found the result already.
3:06
We are going to publish a formal
3:08
incident report shortly.
3:11
And basically, the investigation has
3:12
found that the attacker exploited
3:15
a vulnerability in a third-party
3:17
security product to obtain
3:19
high-level internal credentials.
3:21
Then the attacker used these
3:23
credentials to send fraudulent
3:25
withdraw comments to
3:27
the water system.
3:28
Causing it to execute
3:30
normal transfers that bypassed
3:32
our risk control system.
3:35
Well, along the way, private keys
3:36
were not compromised.
3:38
Cold wallets were not affected.
3:41
And where we are now, so we
3:43
have already confirmed that
3:45
approximately 388
3:47
million equivalent
3:49
USDT equivalent of
3:51
cryptocurrencies in assets were
3:53
transferred out.
3:54
And now we have Mandiant and
3:56
Slow Mist as two separating
3:59
independent organizations
4:01
supporting us to do investigation
4:03
and the on-chain tracing
4:05
efforts.
4:06
We're going to publish the
4:08
address, sorry, not address,
4:10
the report really soon, but even
4:12
on the first day of the incident,
4:13
we've already published the
4:15
identified attacker addresses
4:17
and some relevant tracing data
4:19
to support the border industry
4:22
collaboration.
4:23
We've launched some bounty program,
4:25
and that's the hackers
4:27
tracing part.
4:28
In terms of our users, all the users
4:30
are not affected in
4:32
terms of their user balance.
4:34
The losses from this incident will
4:36
be fully covered by our
4:38
own bigot user protection fund,
4:40
which we established in 2022.
4:43
So we will use our own
4:45
capital from the protection
4:47
fund to cover the loss.
4:49
And we will then use our other
4:51
capital to replenish the
4:53
fund back to at least
4:55
300 million in a
4:57
week.
4:58
I'll stop here and maybe
5:00
take more questions, but of course,
5:02
about the details of the incident,
5:04
there are more things that we can
5:05
discuss.
5:07
Yeah, sure. I think the first thing
5:08
for me is how quickly your
5:10
team was able to figure out what had
5:12
actually happened. I think most
5:14
victims
5:16
of these kind of attacks, that's the
5:17
hard part.
5:18
And it seems like internally, BitGit
5:20
was able pin down how
5:22
this actually happened, was that
5:24
thanks to this third party that
5:26
was involved? How did you kind of
5:27
figure out that this is actually
5:28
what happened and how the attackers
5:30
gained access?
5:31
And do you think that this is also
5:33
the result of having access to?
5:35
Frontier, LLMs, AI models
5:37
to help find vulnerabilities
5:40
in service providers, exchanges,
5:42
the kind of hacks that we've been
5:43
seeing in recent months.
5:45
Yeah, so about
5:49
AI that we can talk about more,
5:50
but let me, before we dive into
5:52
this question, let me give you more
5:54
details on the timing so
5:57
that we get to see what exactly
5:58
happened.
6:00
We mentioned 6.30
6:02
PM, 6.31 PM,
6:04
specifically, on UTC time
6:06
that day.
6:07
That was when the first
6:09
unauthorized waste draw occurred.
6:11
But that amount is actually very
6:13
small. So there were two
6:14
transactions, one Ethereum,
6:17
one TRX, Tron.
6:19
So, there were 0.84
6:23
Ethereum from Ethereum
6:25
Hot Wallet, and then 93
6:27
TRX from a Tron Hot
6:29
Wallet that's
6:31
transferred out.
6:32
So both of these two transactions
6:34
were way
6:36
below the control threshold.
6:39
And they did not trigger any
6:41
system alert.
6:43
But then about half hour later,
6:45
which is at 6.58
6:50
PM that day, the
6:52
attacker started to initiate large
6:55
transfers.
6:57
They've initiated 17
6:59
large transfers across Ethereum,
7:01
XRP, ZEC, BSC,
7:03
base ARB, Optimism and
7:06
Avalanche since 6.
7:08
58 to 809
7:11
PM that day, UTC again.
7:13
And that's a total volume,
7:14
sorry, total value of approximately
7:17
361 million
7:19
USDT equivalent of cryptocurrencies.
7:23
So that's the major losses that we
7:25
were bleeding.
7:27
But the system actually reacted
7:30
pretty quick.
7:32
So within seven minutes of
7:34
their first large transfer,
7:36
At 7.05 PM
7:38
that day, our reconciliation
7:40
system detected a significant
7:42
discrepancy.
7:44
And the risk system automatically
7:46
blocked user-initiated
7:48
withdrawals platform-wise.
7:51
But this didn't really
7:53
stop the hackers'
7:55
behavior. We can explain slightly
7:58
further why.
8:00
Actually, down to
8:02
the ground. The hacker
8:04
pretty much just pretended
8:06
a
8:08
credential or sorry,
8:11
so they, okay, I'll just go to that
8:13
session first.
8:14
So there were three steps that
8:16
the attacker did.
8:17
Step one is that they obtained
8:19
internal credentials
8:21
and accessed our
8:23
internal system.
8:24
How did they achieve that?
8:26
They achieved that by using,
8:30
using or, exploring
8:32
a third party products
8:34
zero day vulnerability that
8:37
we are working with.
8:38
So it's not our vulnerability,
8:40
it's a third-party products
8:42
vulnerability.
8:43
But that vulnerability allow
8:45
the attackers to gain access
8:48
to this critical
8:50
internal management system that we
8:51
have.
8:52
And hence hackers pretended
8:55
to be a
8:57
real person, a
8:59
real management.
9:00
Credential and this
9:03
impersonated identity information,
9:05
because it's a real one and it's
9:07
valid one, the
9:09
system just treated this access as
9:11
a normal login
9:12
from the credential.
9:15
So that's the first step.
9:16
Then the second step is
9:18
the attackers used,
9:22
they created some fraudulent
9:24
withdrawal commands and caused
9:26
the wallet system to execute these
9:28
transfers.
9:29
So they use this compromised
9:31
administrative privilege that
9:34
they accessed the wallet-related
9:36
backend servers and directly
9:38
inserted the fraudulent withdrawal
9:40
commands into the wallet system.
9:43
The wallet system treated these
9:45
commands as legitimate withdrawal.
9:47
So they allow the attackers to
9:49
bypass the withdrawal risk control,
9:51
and that would normally apply
9:53
before a withdrawal record is
9:55
generated and the transfer
9:57
assets from the hot
9:59
and warm wallets,
10:01
that's the second step.
10:02
Then the third step is also,
10:05
in my opinion, the trickiest part is
10:07
that they've been also erasing the
10:09
traces.
10:10
So after completing the transfer,
10:13
the attacker deleted all the
10:15
traces that the fraudulent
10:16
withdrawal comments might have
10:18
left behind in an attempt
10:20
to conceal the attack and
10:22
hinder the root cause
10:24
identification.
10:25
So due to the lack of these
10:27
direct evidence, we needed
10:29
to examine a
10:31
broader range of systems to identify
10:33
the root cause.
10:35
And that's why it took
10:36
longer and more
10:39
sort of coverage on
10:41
different chains, on different
10:42
system, et cetera,
10:44
so that we can remediate
10:47
and fix the problem.
10:49
So now after
10:51
remediation, the subsequent
10:53
verification process,
10:57
following remediation.
10:58
Sorry, I've been talking a lot, but
11:00
basically that's like a third part
11:02
of erasing traces.
11:05
Yeah, I'll give you a moment there
11:07
just to, maybe have
11:09
a sip of water and catch your breath
11:10
while I tee up the next question.
11:12
I think the next
11:14
that comes to my mind and something
11:15
you've already touched on a little
11:16
bit on social media
11:18
was links to
11:21
previous
11:23
hacks and potentially
11:25
identifying that this hack
11:27
was carried out by North Korean
11:28
linked hackers.
11:29
Can you tell us a little more about
11:31
what you know so far before we...
11:33
Pull on that thread a little bit,
11:35
tracing the funds where the
11:37
attackers have been mixing some of
11:39
these funds or carrying out token
11:40
swaps.
11:41
Yeah, so my
11:43
stand still stands,
11:46
whichever we mentioned earlier in
11:48
the 25th.
11:49
But because we are also
11:51
going to publish an incident
11:53
report together with
11:55
Mandate, which is a Google
11:57
Cloud company, and then Slowmist,
11:59
both of them are writing
12:01
independently to
12:04
recover the facts and
12:06
so that we can tell
12:08
everyone and we have more
12:10
confidence.
12:11
To be sure that this is exactly the
12:13
fact of the incident itself.
12:15
So that incident report
12:17
will discover and will discuss
12:20
the hacker's
12:22
identity, the exact
12:24
or at least give you more
12:26
technical and
12:28
context about what we explained
12:30
earlier on how this incident
12:32
happened. So before
12:34
this report is
12:36
finalized and published
12:39
I wouldn't want to
12:41
speculate on the
12:43
exact hacker.
12:46
But personally,
12:48
the decision or the so-called
12:50
earlier speculation didn't
12:52
really change.
12:54
So it's still the same group of
12:55
people that we suspect.
12:57
But let's wait for the
12:59
formal incident report.
13:01
I think that's an easier way to
13:03
prove and publish
13:05
information.
13:07
Yeah, sure. I mean, we can follow
13:09
breadcrumbs and make some
13:10
assumptions, but it's only final
13:12
when we know that we can point a
13:14
finger in that direction.
13:16
But on-chain data, this is the
13:17
beauty of on-chained data is it
13:19
allows you to make some
13:21
educated guesses ahead of time.
13:23
And it's very interesting to see
13:24
that that's what that's pointing
13:25
towards.
13:26
Just pulling on that vein, I'm
13:28
not sure how much you want to talk
13:29
about this, but I know you had said
13:31
online that you'd asked
13:33
ThorChain to step in and block
13:34
some on-Chain swaps that were going
13:36
on. They've turned around and said
13:37
that look, we're permissionless
13:39
network, we can't quite do that.
13:41
This is also just the nature of
13:42
crypto, right?
13:44
Getting people to stop token swaps
13:45
happening on permission networks is
13:48
very difficult to do.
13:49
If they went through a mix or
13:50
something like that, it would be a
13:51
similar situation.
13:52
But it does allow us to trace
13:54
on-chain funds and see where
13:56
things are going.
13:57
Just your general thoughts on what's
13:59
happened there.
14:00
Yeah, so for
14:02
Thornchain, as people might
14:04
know, I send them a public
14:07
so-called message asking
14:09
that ThornChain not to
14:11
serve the
14:13
fraudulent hackers
14:16
or any addresses that's
14:18
obviously attacked
14:20
already.
14:21
I ask that they come
14:23
from the
14:25
stolen funds from us.
14:26
So like
14:28
what you mentioned earlier,
14:29
Thornchain also replied
14:31
publicly that they
14:34
claim that they are just like
14:36
Ethereum and Bitcoin and they
14:38
wouldn't be able to do
14:40
anything about it, basically use
14:41
decentralization.
14:43
Although I said this specific word
14:45
that as excuse to
14:48
just as a reply.
14:51
I'm a little bit frustrated about
14:53
that reply, but over
14:55
the weekend was very busy with
14:57
a lot of So they don't really have
14:59
time to
15:01
reply nor continue
15:03
any sort of like a fight.
15:05
This is not a fight that I want to
15:06
get into.
15:07
I also respect decentralization
15:10
a lot. I appreciate Bitcoin's
15:13
design of decentralization
15:15
and node operation, contributions,
15:17
et cetera. Like how nodes and
15:19
miners, et cetera, all work very
15:21
definitely in order for that
15:23
blockchain to work similarly for
15:25
Thronechain.
15:26
So for today,
15:28
I tried to approach
15:30
ThroneChain privately as well
15:32
through some third party
15:35
organizations that might know them.
15:37
So far, there isn't any direct
15:40
response from their team,
15:42
but I want to just
15:44
call out and say because
15:47
this is like a
15:49
repeated pattern that we see that
15:51
hackers use Thronechain to
15:54
launder the stolen assets.
15:57
From Bybit's case,
15:59
from CalpDAL, from us.
16:01
Like all these just hit the
16:03
same pattern.
16:05
So while respecting the
16:07
permissionless design fully,
16:09
we also want to talk
16:11
to them and discuss from
16:13
the people, the developers who
16:15
are actually running it to
16:17
understand what's technically
16:19
and governance wise possible
16:21
so that we can find something
16:23
workable together.
16:25
Yeah, so this is the key message
16:27
that I want to send to them.
16:28
If there is anyone who are
16:30
hopefully listening to this podcast
16:32
that might be helpful, please reach
16:34
out to me directly.
16:36
My DM is open on
16:39
Twitter, x.com.
16:41
We want to work together with
16:43
not just Thorn Chain, but any
16:45
other decentralized
16:47
or centralized infrastructure to
16:50
stop hackers from
16:52
laundering those stolen assets.
16:55
Yeah, sure. If anyone from ThorChain
16:57
is listening, please check your DMs.
16:59
Gracie's trying to reach out.
17:00
And I think it's only fair that
17:02
we have a lot of collaboration.
17:03
I mean, Gracie, we saw this last
17:05
year with Bybit.
17:06
The industry really came together
17:07
and assisted when
17:09
Ben and Bybit were down.
17:11
You and BitGit specifically
17:13
contributed a lot of ETH
17:16
to help that recovery effort.
17:18
Can you talk a little bit about the
17:19
support that you've had in the last
17:20
few days? Cause it's been a
17:21
difficult time, but I'm sure.
17:23
You've probably experienced
17:23
something similar with a lot of
17:25
people reaching out to you and
17:26
assisting, perhaps one
17:28
or two of them deserve a mention
17:30
and who's been the most helpful out
17:32
there and yeah, who
17:34
came to your aid that you wanna give
17:35
a shout out today.
17:37
Sure.
17:38
There are obviously a lot of people
17:39
that want to think.
17:42
I don't know if I can
17:44
make a full list now, obviously
17:46
not just within my head
17:48
right now, but I'll do my
17:49
best. So for
17:51
a foundation or organization
17:53
level who helped us stop some
17:56
funds, I want to shout out
17:58
to Tether and Circle specifically
17:59
that they acted very quickly
18:02
within a couple of hours.
18:03
That they froze some
18:05
funds that's stolen,
18:07
that's the stolen assets we have.
18:10
Right now, freezing is
18:12
relatively easier
18:14
to happen, although it's still not
18:16
a high percentage that we're looking
18:17
at.
18:19
But at least they can do some
18:21
freezing there.
18:23
The returning is much harder
18:25
and that requires a
18:27
lot of like legal, et cetera,
18:29
sort of process.
18:31
But at least I want to appreciate
18:32
them. And a couple of other
18:34
organizations who help us
18:36
throw some funds.
18:38
And then from the security
18:40
groups and security
18:42
companies, I want to thank
18:44
Mandiant and Slow Mist
18:46
for formally working with us
18:48
as partners to help
18:50
us discover the roots and
18:52
publish the incident report.
18:55
I also want to shout out to SCAL911
18:58
as an individual
18:59
country.
19:02
They are actually a voluntary base
19:04
group that are
19:07
white hat hackers that they
19:09
actually know exactly how
19:11
hackers work.
19:13
By the way, one of
19:15
the very first notification
19:17
that I got at
19:19
my 4 a.m.ish
19:21
in the GMT
19:24
plus eight time zone on
19:26
that day, which is only one
19:28
and a half hours after
19:30
the incident happened.
19:31
Is actually from the SCAL
19:33
9-1-1 group, and
19:36
as well as my internal group.
19:38
So they might publish that
19:40
earlier than the
19:42
specific timestamp
19:44
that I'm quoting, but that's
19:46
timestamp that I started to, that I
19:48
saw.
19:49
But SCAL, 9-11,
19:51
as an individual and
19:53
a voluntary base group,
19:55
they have been very helpful in the
19:57
last few days.
19:58
To help us identify
20:01
a lot of traces.
20:02
My team and their team have been
20:03
working together for a
20:05
couple of years already to
20:08
help recovering other people's
20:10
funds.
20:11
But this time they are
20:13
proving quite helpful to
20:15
recover, at least
20:17
to track the
20:20
Lawson Fund as well.
20:21
And then I also want to shout out
20:23
to a lot of peer exchanges.
20:25
Actually, you might see this.
20:28
Public already,
20:30
that all the topics changes,
20:32
including finance, 5-8,
20:34
OKX, Maxi,
20:36
et cetera, have been
20:38
publishing something
20:40
publicly and reaching out
20:42
to us also privately to
20:44
help on different angles.
20:47
There are different level of
20:49
involvements, of course,
20:51
but generally, even if
20:53
we are competitors in general,
20:56
we are, I would call us.
20:57
Cause friend-enemies
20:59
in general, but basically in a
21:01
situation like this, we're
21:03
definitely more friends than
21:04
competitors, and I
21:06
appreciate their help.
21:09
Yeah, needless to say,
21:12
frenemies is probably the right way
21:13
to call it, but most people come
21:16
to your aid when things are
21:18
looking down.
21:18
I know you probably can't say too
21:20
much about this, but I would take
21:22
that a formal sort of criminal
21:23
investigation is underway as
21:25
well, and you're working with
21:26
international authorities.
21:27
Is that the case?
21:29
And what can you tell us about who's
21:30
helping you so far, and if there
21:32
is any sort of
21:34
leading information that you have at
21:35
this stage?
21:36
Hmm So,
21:38
from a regulator's point of view,
21:40
we've already notified law
21:42
enforcement agencies and
21:44
financial intelligence units in
21:46
multiple jurisdictions.
21:48
So we are collaborating with them,
21:50
with all the relevant authorities.
21:53
There are also certain regulators,
21:56
because we are applying for
21:58
their license, etc.,
22:00
we've been very transparent
22:02
and upfront sharing the
22:04
information and the incident with
22:06
them as well.
22:07
So other than
22:09
these authorities or regulators,
22:12
we've also contacted a lot
22:14
of blockchain foundations,
22:16
ecosystem participants to assist
22:17
with the containment and
22:19
asset recovery.
22:21
I mentioned some of their names
22:22
earlier, but I also want to
22:24
highlight, this is a very primary
22:27
name of names or
22:29
list of people in organizations that
22:31
we want to think.
22:33
Because I don't
22:35
have the full information.
22:37
I do have team members who
22:39
are dealing with all
22:41
the external communication
22:43
around blockchain foundations
22:45
and ecosystem participants
22:47
specifically.
22:48
So we haven't got a time
22:50
to aggregate the full list of
22:52
people we want to think, which I
22:53
will do this week.
22:54
But right now, all
22:57
these foundations that we've
22:59
reached out have been pretty
23:01
collaborative.
23:02
But again, due to the nature of
23:05
decentralization designed in
23:07
many public chains, et cetera,
23:10
there are very limited things
23:12
that they can do.
23:13
So for example, if we refer
23:15
to the Bybit's case,
23:19
the total amount that they lost,
23:21
more than 1.4 billion, actually
23:23
there were only 3.5 percent
23:25
of the stolen funds that's
23:28
frozen after a year.
23:30
And the part of funds that
23:32
they can get returned is even
23:34
much smaller.
23:36
We are expecting similar situation
23:38
here. So we don't count
23:40
on recovering the
23:42
funds to recover our
23:44
loss. That's why we have the
23:45
protection fund. We've been dealing
23:47
with the withdrawal, et
23:49
cetera, for our users.
23:51
At least not counting
23:53
on getting those money back
23:55
is a key message
23:57
here. But we are doing our best
23:59
to trace the
24:01
funds, to publish
24:03
information, to work with
24:04
organizations, to issue
24:07
some police reports
24:09
so that organizations can
24:11
also work with us.
24:12
A lot of things that we've been
24:13
doing back at the background
24:15
from my legal team,
24:18
especially some blockchain
24:20
experts that we have at the company
24:22
from the technical team.
24:23
Even from my listing team who
24:25
because they have a lot of
24:26
connection with those foundations
24:28
and partners So it's
24:30
a team effort and I've been
24:32
Seeing a lot collaborations
24:34
within the beginning to
24:36
be get as a company and within the
24:38
industry
24:39
Gracie, I just wanted to ask you
24:40
about the user protection fund.
24:42
Obviously you're gonna have to use a
24:43
large portion of what was saved
24:45
up in that fund to cover the
24:47
losses here. And as you've mentioned
24:48
now, it might be very difficult
24:50
to claw back
24:52
stolen funds and you're not counting
24:54
on doing that.
24:55
How are you gonna go about
24:57
replenishing this fund?
24:59
Is that something that you would
25:00
just do quite quickly or is it gonna
25:02
take a few months or a few years
25:04
to get up to the same
25:06
level of coverage that you
25:07
had in that fund up until.
25:09
This incident.
25:11
Yeah, so for the protection
25:13
fund, as we
25:15
mentioned earlier, yes, we are going
25:16
to use the money from protection,
25:17
and we've been already using
25:19
the money from protection fund to
25:21
cover users' withdrawal
25:23
requests and the losses, et cetera.
25:26
For the replenishment,
25:29
actually it's going to be much
25:30
faster, so we
25:32
are to put it back
25:34
to more than 300 million
25:36
within a week.
25:37
So very soon
25:39
you should see that the
25:41
protection fund being back to
25:44
more than 300 million, although
25:45
right now it's 465
25:47
million on the day
25:50
of the 25th of
25:51
the incident.
25:52
And that's the number we estimated
25:54
according to that times the
25:56
Bitcoin price. I know Bitcoin
25:57
dropped a little bit in
25:59
these last couple of days.
26:01
But it should still be more
26:03
than enough. And by the way, when we
26:04
are doing the replenishment, we
26:06
still plan to use Bitcoin
26:08
to be
26:10
the main assets in this protection
26:12
fund.
26:12
Protection fund was established
26:15
in 2022 before FTX
26:17
collapse. This is the first time
26:19
that we needed to use it
26:21
in a big amount
26:22
of money.
26:24
But this is not really affecting
26:26
us in
26:28
terms of day-to-day operations and
26:31
probability.
26:32
Actually, if you look at the impact
26:34
of this incident on our operations,
26:37
it's actually very limited because
26:39
throughout the incident, deposits,
26:42
trading, earning, and a lot
26:44
of services just continue to
26:46
operate very normally.
26:47
And our team also
26:49
worked as usual, or even
26:51
maybe more than usual, because it's
26:54
also a weekend, public holiday, et
26:55
cetera, that everyone is working.
26:58
Nobody made any complaint.
27:00
We just know that this is the time
27:02
that we need to pull back from
27:04
any holiday or any weekend that
27:06
we have to be together and
27:08
work together.
27:09
So all the daily
27:11
operations, team-wise,
27:13
customer-wise,
27:15
back to normal.
27:16
And for the financial
27:18
positions specifically,
27:22
other than the protection fund, we
27:23
also have a lot of capital,
27:26
a lot for corporate funds.
27:28
There were a financial
27:30
report that we did
27:32
with auditing firm on
27:33
August 31, that can
27:35
show Big Hit has more than
27:37
1.4 billion in
27:40
corporate funds, and that includes
27:42
our protection fund.
27:44
So the 388
27:46
million involved in this
27:48
incident falls entirely
27:50
within the buffer provided
27:52
by protection fund.
27:54
And hence, after the
27:56
assets were
27:58
after the protection fund were used,
28:01
we are just going to use our
28:03
corporate reserve to replenish
28:05
the protection funds and
28:07
then, again, put it
28:09
back to more than 300 million.
28:11
And I want to be very clear that
28:13
an incident like this
28:15
scale is very serious.
28:18
We're not downpaying it.
28:20
And we do accept that all
28:22
the responsibility for
28:24
what happened and
28:27
we, I think this is
28:29
a very serious situation.
28:31
But serious doesn't mean
28:33
existential.
28:35
We do have the reserve, we do have
28:36
the team and the capability to
28:39
go through this.
28:40
And I was safe.
28:41
Of turning crisis into
28:44
an opportunity and even emerge
28:46
stronger.
28:47
I have no doubt you'll emerge
28:48
stronger, Gracie.
28:49
You're a very tenacious person.
28:50
And yeah, I think it goes without
28:52
saying that the entire industry's
28:54
behind you.
28:55
And again, this has happened across
28:57
the board to multiple different
28:59
players in our industry.
29:00
And I don't think it's any
29:01
indictment on what you've been
29:03
doing. And really, we're just
29:04
appreciative that you would take
29:05
half an hour out of your day to talk
29:07
to us after the incident, because I
29:08
know you're probably just running on
29:10
fumes at this stage and working
29:11
20-hour days or more.
29:13
My final question.
29:15
What are the next few days or
29:17
weeks look like for the
29:19
BitGet team? What are you really
29:20
focusing on right now?
29:21
Is it user redemptions and user
29:22
experience and working
29:24
with law enforcement to
29:26
trace funds?
29:28
Yeah, what are you guys gonna be
29:28
spending your time on?
29:29
In terms of spending our time,
29:31
yes, I think all the things you
29:33
mentioned are very valid that we
29:35
plan to do as a team.
29:37
The most important thing right now,
29:40
at least for the client level,
29:42
would be to allow all
29:44
the withdrawals happen
29:47
smoothly.
29:48
So on Monday,
29:50
that's just the first day, which is
29:52
about Bitcoin withdrawal.
29:53
It went very smoothly.
29:54
But the coin
29:56
mainnet is not the
29:58
part of. The blockchains that
30:00
we were exposed during
30:02
the hack.
30:04
Ethereum and XRP are the
30:06
two major assets that's
30:09
affected.
30:10
So tomorrow, we are going to have
30:12
a slightly harder day, in my
30:13
opinion, because we are going to
30:15
start withdrawal for Ethereum.
30:18
So all these things
30:20
went smoothly, go smoothly.
30:23
I also, again, believe that
30:24
our business will just gradually
30:26
return to normal.
30:28
So this week is about all
30:30
the things that you mentioned.
30:32
But this, again, is a
30:34
setback that I don't think will
30:36
change what we set out to
30:37
do or what we believe in.
30:40
I've always also believed that
30:42
our people are the greatest
30:43
strengths.
30:44
So we are going to stand together,
30:46
keep our clients, hopefully keep
30:48
them happy.
30:49
And even if we lost them in
30:51
the short run.
30:52
That again, we just welcome all
30:54
the users to please do withdraw if
30:55
you want to.
30:57
But hopefully we can also win them
30:58
back shortly
31:00
in hopefully in a month
31:02
or so that again
31:05
everything can be back to normal.
31:07
And we are
31:08
going to build the future we believe
31:10
in and I'll
31:12
do it one step at a time.
31:14
I'm reminded of last year's
31:15
incident with Vibit and Benjao,
31:18
taking all that time to speak to
31:19
people. And I think you've done
31:20
exactly the same thing here, Gracie.
31:21
So I think that's important for
31:23
everyone in the industry to get
31:24
behind and provide some support.
31:26
If they have any information, share
31:28
it with you and your team.
31:29
But yeah, we will be in
31:31
Singapore next week for
31:33
Token 2049, so I'm sure we'll all
31:35
catch up then to you and you team,
31:37
good luck. I hope you do get a
31:38
little bit of rest.
31:39
And again, just thank you for taking
31:40
the time to chat to the block today
31:42
and give us an update on everything
31:43
that's been happening. I know it's
31:44
been a difficult few days.
31:47
Thank you, thank you so much,
31:49
Garrison. Thank you the block team.
31:50
Thank you very much, Gracie, and
31:51
thank you for watching the starting
31:53
block today. We're gonna be stopping
31:54
the show there. We will be
31:55
broadcasting the rest of the week,
31:57
and then we are off to Token 2049
31:59
next week for a busy week
32:01
in Singapore. So we'll catch you
32:02
tomorrow, normal time, 8.30 Eastern
32:03
time if you're in the US, 2.30
32:05
Central European time.
32:07
Put a reminder on your calendar,
32:08
come and join us.
32:09
We'll catch ya next time.