Bitget CEO says exchange does not expect to recover much of its $388m hack

Bitget has frozen about $1.1 million of the nearly $388 million stolen from the crypto exchange in last week's cyberattack, and its chief executive does not expect much more of the money to come back.

Gracy Chen said on CNBC's "Squawk Box Europe" that she was "not expecting to recover a lot of funds", pointing to the limited recoveries after earlier exchange hacks. Frozen assets have not necessarily been returned to Bitget, she said in an email interview, and she did not disclose how much had been recovered.

Bitget says user account balances were unaffected. It has refilled its Protection Fund to $300 million using its own reserves. The fund was valued at more than $464 million before the theft and fell below $200 million afterwards, according to Bloomberg's calculation of its disclosed wallet addresses. "The financial impact is being absorbed by Bitget rather than passed on to our users," Chen said.

Investigation reports released on 30 September by Mandiant, part of Google Cloud, and blockchain security firm SlowMist found that the attackers compromised two third-party security products before reaching Bitget's production wallet systems. SlowMist traced the earliest malicious activity to 31 August, when a previously unknown vulnerability was exploited. Mandiant said the attackers bypassed the normal withdrawal process without stealing private keys. Chen declined to name the vendors, citing security risks.

The reports did not attribute the attack to North Korea, although Chen had earlier said preliminary technical indicators were consistent with known North Korean hacking groups.

A separate exploit hit Near Intents, a service for swapping crypto across blockchains. It stopped operations on Thursday after an attacker drained about $3.8 million through a bug in its Omni deposit and withdrawal layer, Decrypt reported. Two days earlier, Near Intents had blocked a $50 million swap attempt by the Bitget hacker. It is not clear whether the incidents are related.

Bitget says withdrawals of bitcoin, ether and USDT have resumed, with its remaining cryptocurrencies, fiat and peer-to-peer services scheduled to restart on Friday. Near Intents has promised to compensate users in full and to publish a detailed report in the coming days.

Sources

• CNBC
• Decrypt