Bitget CEO details September's $388M hack and a new bank-custody model for exchanges

A $388 million hack exposed the limits of the old exchange model

Gracy Chen recounts that on September 24th UTC evening, Bitget detected unauthorized transfers from its hot and warm wallets, totaling an estimated $388 million stolen. She says the hackers got in through third-party vulnerabilities, and that private keys and cold wallets were not compromised. Small test transfers began around 2:30 a.m. her time, with larger transfers following around 3 a.m.

Chen says she woke naturally before 4 a.m., prioritized figuring out losses and whether the root issue was patched, then went on a livestream within hours to communicate transparently with the community. She says Bitget used a protection fund established since 2022, before the FTX collapse, to cover the loss, and replenished it to more than $300 million. User balances, she says, were not affected.

"But above all, I think we remain calm... the most important thing is our users balance are not affected." — Gracy Chen

Chen argues the "one giant monster" exchange model is an unfair fight against hackers

Chen describes the traditional exchange model as one entity handling clearance, custody, trading, liquidity and even earning products — what she calls "one giant monster." She argues this concentration makes defense asymmetric: exchanges must be perfect, while attackers only need one small flaw.

"100% versus, you know, 0.01% — that's an unfair game." — Gracy Chen

She references Binance's own disclosed breach, where she says engineers were socially engineered via fake HR interviews, leading to $6.3 billion stolen in that case, versus $388 million at Bitget. She frames rising AI-powered hacking as making this old structure harder to sustain.

The Bitget Open Custody Network: "assets in bank, trading on Bitget"

Chen unveils the Bitget Open Custody Network (OCN), describing it simply as moving custody to banks and specialist custody firms while users continue trading on Bitget. Custodians include both named-but-unspecified major banks with digital asset arms, newer digital banks such as one established in Switzerland, and large Europe-headquartered custody firms. She says she personally met with an Asia-Pacific head of a major bank this week to discuss custody.

She distinguishes this from the old model's third parties (VPNs, data centers) that supported infrastructure while exchanges still held custody. In the new model, custody itself is offloaded to larger, specialized organizations. Chen says the network is "open" in that other exchanges could in theory join, though she does not expect this to become a Bitget business line.

Institutions and VIPs come first; convenience is the tradeoff

Chen says the product currently targets institutional and major VIP clients, who often already have preferred custodians based on licensing, jurisdiction and track record. Retail users who trade frequently with small amounts are, for now, not the target audience, since custody adds delay and reduces convenience. She suggests that in roughly half a year, Bitget might default smaller retail accounts into custody automatically to lower the friction of choice.

Asked whether this contradicts crypto's self-custody ethos, Chen says cryptocurrencies are becoming "alternative asset classes" accepted by traditional finance, citing NYSE and Nasdaq extending trading hours and launching tokenized solutions, alongside JPMorgan, BlackRock and Fidelity's digital asset efforts. She argues the industry must move from "a boy playing with new narratives" to an adult focused on security and legitimate business models.

Her three-year test for success, and acknowledging it's just one possible future

Asked whether OCN is "the" future of crypto security, Chen calls it "one of the futures," not the only path. Her benchmark for success in three years: at least half of Bitget's total AUM held by third-party custodians, with no breaches at custody partners and a user experience that remains "pretty smooth." Industry-wide, she hopes other exchanges adopt similar custody-offloading models, though she acknowledges this is difficult since it means exchanges giving up AUM and control.

"This is not necessarily you know getting more AUM to my platform because I'm putting I'm pushing some AUM away. But it's for the outer good of this industry of our users." — Gracy Chen