Bitget CEO Gracy Chen Reveals $80,000 Loss from Lazarus Group Cyber Attack

This incident reveals vulnerabilities in human-layer security that can have widespread implications for the cryptocurrency industry.

• Gracy Chen, CEO of Bitget, disclosed a personal loss of approximately $80,000 due to a social engineering scam linked to North Korea's Lazarus Group.
• The attack involved hackers compromising a crypto media outlet's X account to impersonate journalists and conduct a fake interview.
• This incident coincided with a larger $387.5 million breach at Bitget, attributed to the same threat actor.

• Lazarus Group is known for targeting cryptocurrency exchanges and executives through sophisticated social engineering tactics.
• High-profile crypto executives often engage with media, creating exploitable trust vectors when accounts are compromised.
• The attack on Chen involved multiple layers of deception, including compromised communication channels and a fake interview setup.

On September 25, 2026, Gracy Chen, the CEO of Bitget, publicly revealed a personal loss of approximately $80,000 due to a social engineering attack orchestrated by the notorious Lazarus Group, a North Korean state-sponsored hacking collective. This incident is not just a personal setback for Chen; it reflects a broader vulnerability within the cryptocurrency sector, particularly concerning human-layer security.

The attack began approximately 1.5 years prior to the disclosure when hackers compromised the X account of a major crypto media outlet. By impersonating journalists, the attackers initiated contact with Chen under the guise of conducting an interview. This initial contact was followed by further engagement with her PR team and assistant through compromised Telegram channels, which helped build credibility and trust. The culmination of this deception was a Zoom interview that ultimately led to the compromise of Chen's personal MetaMask wallet, resulting in the loss of around $80,000 in Ethereum and other assets.

This incident is particularly alarming given that it coincided with Bitget's detection of unauthorized transfers totaling $387.5 million from its hot and warm wallets. These transfers were executed using spoofed transaction data, indicating that the attackers had sophisticated methods to bypass security measures without compromising private keys. Chen noted that the operational signatures of this attack were consistent with previous Lazarus campaigns, suggesting a well-orchestrated effort to exploit vulnerabilities in the cryptocurrency ecosystem.

The implications of this incident extend beyond Chen's personal loss. Bitget activated emergency protocols, froze withdrawals, and referenced its $464 million User Protection Fund to cover user losses from the related breach. However, Chen's personal loss fell outside this coverage, highlighting a gap in protections for individual executives. Industry commentary has since focused on the need for enhanced human-factor security protocols, emphasizing that technical infrastructure alone is insufficient to safeguard against such sophisticated attacks.

As the cryptocurrency industry continues to grow, the need for robust security measures that encompass both technical and human elements becomes increasingly critical. This incident serves as a wake-up call for executives and organizations to reassess their security protocols and ensure that they are not only protecting their assets but also their reputations and personal finances.

• Crypto Executives: Increased scrutiny on personal security measures and potential reputational damage.
• Crypto Exchanges: Heightened focus on security protocols and user protection funds.
• Investors: Concerns about the safety of their assets and the integrity of exchanges.
• Media Outlets: Need for enhanced security to protect against account compromises.

• Increased Security Measures: Watch for crypto exchanges to implement more stringent security protocols in response to this incident.
• Regulatory Scrutiny: Expect potential regulatory actions aimed at improving security standards across the cryptocurrency industry.
• Public Awareness Campaigns: Look for initiatives aimed at educating crypto executives and users about social engineering threats and protective measures.