Crypto Exchange Bidget announced its plans to purchase Thailand’s GMO-Z Internet, a move that was meant to expand its Southeast Asia footprints. Z.com EX launched in 2021 with approval from the Thai SEC and Finance Ministry. Thailand banned several unlicensed foreign platforms last year operating without licences, making an exchange with existing approval a much easier way into the market.
GMO Internet reported the sale on Sept. 24, the same day Bitget's hot wallets were drained. The first unauthorized transfers took place at 18:31 UTC, or 3:31 a.m. on Sept. 25 in Tokyo, meaning the sale appears to have been reported before the theft began. Bitget was already working through the deal when the breach happened.
The hack could complicate that approval process. SlowMist traced the earliest malicious activity to Aug. 31, four weeks before the stolen funds began moving. Mandiant later found that the attackers had gained access through a third-party security appliance before moving into Bitget's production wallet job server. Neither security firm identified the vendors involved. Estimates of the losses also climbed, rising from $351.6 million to $387.5 million across 11 blockchains.
On the financial side, Bitget's protection fund held more than $464 million before the theft, but Bloomberg's count of the exchange's revealed wallets later put it below $200 million. It has since recovered to more than $300 million. Bitget's Sept. 29 proof-of-reserves report, which the company published itself, showed a ratio of 131%. So far, only about $1.1 million has been frozen, and CEO Gracy Chen told CNBC she was "not expecting to recover a lot."
Who was behind the attack is still not clear. Chen said the attack looked allot like the the methods used by North Korean groups, while Elliptic rated a North Korean connection as highly likely. ZachXBT also named five people on X whom he accused of laundering the proceeds for the alleged attackers. Neither of the two forensic investigations, however, publicly attributed the breach to a specific group.
Both companies are looking to complete the deal by Oct. 31, but the hack could complicate further proceedings. Thai regulators are likely to look beyond the licence and examine how such a flaw in a third-party security appliance went unnoticed in Bitget's wallet environment for weeks. They'll also want to see evidence that the vulnerability has been fixed, rather than just take the exchange's word for it. Bitget says it has patched the flaw, but proving that to regulators is another issue on its own. The deal still needs approval for the change of ownership, and neither company has disclosed its financial terms.