Bitget CEO Gracy Chen: Mandiant and Slow Mist Involved in Investigation
Chen Qin stated that they are conducting a comprehensive investigation into the hot wallet incident with independent third parties Mandiant and Slow Mist. She reiterated that user balances are intact, and the protection fund covers platform-level losses; Bitget Wallet, being self-custodial and separate from the exchange, is unaffected; deposits and trading rewards continue as usual, while withdrawals are suspended until additional verification is completed, and will be restored as soon as safety is confirmed. Progress will only be communicated through official channels.
Mandiant is an incident response company under Google Cloud, and Slow Mist has traced the attack to 11 EVM addresses, 7 XRP Ledger addresses, and 1 Tron address, claiming that the attackers converted EVM assets into ETH. Approximately $351.6 million in stolen assets remain locked, with 19 transactions from hot and warm wallets, while cold wallets remain untouched, and private keys have been excluded. The method of intrusion involves backend forged transaction data triggering the platform's own authorization. CNBC quoted Chen Qin stating that the investigation has identified IPs related to VPNs used by North Korean hacker groups, but the method of intrusion is still undetermined.
The protection fund consists of about 5,500 bitcoins, with a statement value of approximately $464 million. The withdrawal timeline remains "as fast as a few hours, as slow as a few days, but should not take weeks." The involvement of third parties will turn internal conclusions into an evidential chain that can be presented externally, and the timeline will be tied to the progress of both companies. The self-custodial wallet has been separated to prevent users from treating the on-chain wallet in the app and the exchange's hot wallet as the same attack surface.
The buyers mentioned in the investigation announcement are customers still in the withdrawal queue and market makers still trading. Mandiant's brand reduces the discount of "self-investigation," while Slow Mist provides a reputation for on-chain tracking in Asia. The fund commits to resolving ledger numbers, while the investigation addresses when it is safe to reconnect the hot wallet for withdrawals.
In terms of market mechanisms, what is being sold is verifiable third-party endorsement, and what is being bought is a window for evidence obtained by pausing withdrawals. The demand is for users not to liquidate their balances and leave, while the supply comes from the fund and the two security companies. The beneficiaries are the platform's order book that can still trade, while the pressured side is customers needing fiat or on-chain withdrawals. Funds have not yet been fully transferred between the protection address and the stolen address, and investigation costs are covered by operating expenses.
Source: Public Information
ABAB AI Insight
After the hot wallet was drained, the next battle is narrative and withdrawals. Chen Qin mentioning Mandiant and Slow Mist in the same tweet signifies the simultaneous acquisition of Google Cloud's enterprise response and on-chain tracking in the Chinese community. The North Korean IP is a direction, not a conclusion. Excluding private keys eliminates the worst-case scenario, while the backend signing machine being deceived leaves the problem within the operational structure. The declaration of Wallet operating independently aims to prevent users from confusing another product line with the same attack surface.
The capital path remains the $464 million bitcoin fund against the $351.6 million multi-chain hole. The third-party investigation does not change the conversion and replenishment but alters the political permission for resuming withdrawals. In the Bybit precedent, on-chain tracking occurred before system reconstruction; Bitget runs both in parallel and sets a limit for itself with "should not take weeks."
Similar arrangements are seen in traditional banks asking Mandiant to write incident reports before reporting to regulators. The exchange is in a window of "losses locked, withdrawals not opened, report not written." Whoever first presents a verifiable intrusion path can turn on the withdrawal switch without being labeled as a second theft.
Structural judgment belongs to the outsourcing of evidence collection before regulatory changes. The explanation rights for platform incidents have shifted from official Twitter to branded laboratories. The mechanism is: users want to withdraw, and the platform provides that an investigation is ongoing; the more independent the investigation appears, the more the pause seems like a procedure rather than an inability to pay.
ABAB News · Cognitive Law
The involvement of third parties turns the investigation from a statement into evidence.
The separation of the wallet app is to prevent a run on the brand.
The fund manages ledger numbers, while the report manages the withdrawal switch.