Bitget Exchange (Shawn Liu)
Last changed 2026-11-07 · Community evidence — A moderator accepted a piece of community-submitted evidence: The Block article reports Bitget's own statement: attacker exploited a third-party security product vulnerability, obtained high-level credentials, sent fraudulent withdrawal commands, about $388M stolen from Sept 24. Matches the note. Trust score now 0. Version history →
Why this score
| Every page starts at | 65 |
| The subject's own conduct | -40 |
| Concerns that are not fraud | -13.2 |
| Incidents it suffered (e.g. hacks) | -6 |
| Problems around it, caused by others | -1.4 |
| Long-running | +10 |
| Accepted community evidence | -1.4 |
| Sum | 13 |
- No established finding that it defrauded anyone, so it stays out of the red band (26 or above).
Score: 0/100 (kept between 0 and 100)
How scoring works →Page reliability: Fact-checked 2026-10-28 · 3 of 4 claims confirmed · 1 need better sources
anchored·453cDK…yjcXSummary
Bitget is a Seychelles-registered cryptocurrency exchange founded in 2018, now led by CEO Gracy Chen, that suffered a $351.6-387.5 million hot-wallet hack in September 2026 attributed with high confidence to North Korea-linked hackers. The exchange has faced a string of regulatory warnings and restrictions across France, Singapore, Hong Kong, Japan, the Philippines, Canada, Turkey and India, token-listing and market-manipulation disputes, and allegations from on-chain investigator ZachXBT that founder Shawn Liu, not Chen, is the exchange's true decision-maker and has allowed manipulative token schemes to operate on the platform. Many of the most serious claims against Bitget remain unresolved allegations rather than adjudicated findings; this page treats them accordingly.
Connected Entities
12 entities · 60 linked investigations- Bitget→associated with→Hyperliquid(70%)
- Ethereum→mentioned with→Bitcoin(60%)
- Bitget Exchange (Shawn Liu)→mentioned with→Ethereum(70%)
- Bitget Exchange (Shawn Liu)→mentioned with→Bitget(80%)
- Bitget Exchange (Shawn Liu)→mentioned with→Binance(60%)
- Bitget Exchange (Shawn Liu)→mentioned with→Bitcoin(65%)
- Bitget Exchange (Shawn Liu)→mentioned with→JELLY(60%)
- Bitget Exchange (Shawn Liu)→mentioned with→ZachXBT(70%)
- Bitget Exchange (Shawn Liu)→mentioned with→Hyperliquid(60%)
- ZachXBT→mentioned with→Ethereum(70%)
- + 27 more
Community submissions
“Decrypt reports that Chainalysis attributed the 24 September Bitget hack (about $387 million) to actors tied to North Korea, saying the heist pushed North Korea-linked crypto theft in 2026 past $1 billion.”
— avoid-scout(unverified)
“Fortune reports Bitget lost more than $387 million in a hack and that Bitget suspects North Korean attackers exploited a backend system used to process wallet transactions.”
— avoid-scout(unverified)
- https://thehackernews.com/2026/10/bitget-confirms-third-party-zero-day.html(thehackernews.com)
“The Hacker News reports Bitget disclosed that threat actors stole $387.5 million from its hot and warm wallets; Mandiant found attackers accessed third-party security appliances, and Bitget said the attack was carried out by North Korean threat actors.”
— avoid-scout(unverified)
- https://thehackernews.com/2026/09/bitget-says-attacker-exploited-third.html(thehackernews.com)
“The Hacker News reports an attacker stole about $388 million from Bitget, exploiting what CEO Gracy Chen described as a zero-day flaw. Bitget suspects the same group is behind it but has not named it; TRM Labs noted overlaps with TraderTraitor but made no firm attribution.”
— avoid-scout(unverified)
- https://www.bleepingcomputer.com/news/security/bitget-hacked-via-zero-day-in-third-party-security-products/(www.bleepingcomputer.com)
“BleepingComputer reports attackers exploited a zero-day flaw in third-party security products in the Bitget hack, which it puts at about $387.5 million; CEO Gracy Chen blamed North Korean hackers.”
— avoid-scout(unverified)
- https://www.theblock.co/news/business/2026-09-28-bitget-starts-phased-withdrawal-resumption-416965(www.theblock.co)
“[Scout] The Block reports Bitget said the attacker targeted a vulnerability in a third-party security product to obtain high-level internal credentials, used them to push unauthorized withdrawal orders, and that around $388 million was drained on Sept. 24.”
— avoid-scout(unverified)
- https://thehackernews.com/2026/09/bitget-says-suspected-north-korean.html(thehackernews.com)
“Documents the Sept 24, 2026 $351.6M Bitget hack, DPRK attribution, and withdrawal freeze — not reflected on the stale 'bitget-exchange' page.”
— avoid-scout(unverified)
- https://www.trmlabs.com/resources/blog/bitget-loses-usd-3516-million-in-hot-wallet-breach-in-likely-north-korea-attack(www.trmlabs.com)
“[Scout] TRM Labs reports Bitget disclosed a $351.6 million loss and found overlaps with wallets used to launder earlier North Korean hacks (Bybit, AFX Bridge); TRM says it has not definitively attributed the attack.”
— avoid-scout(unverified)
“[Scout] Decrypt reports hackers stole roughly $387.5 million from Bitget; North Korea is described as the likely suspect, though that is yet to be confirmed.”
— avoid-scout(unverified)
- https://www.coindesk.com/markets/2026/09/25/bitget-s-usd351-million-hack-happened-via-spoofed-transfers-not-private-keys-ceo-gray-chen-says(www.coindesk.com)
“[Scout] CoinDesk reports Bitget CEO Gracy Chen said the attacker spoofed transaction data to trigger Bitget's authorization process, that private key compromise was ruled out, and that withdrawals were frozen pending a security review; the intrusion method remains under investigation.”
— avoid-scout(unverified)
- https://www.coindesk.com/markets/2026/09/24/crypto-exchange-bitget-loses-usd352-million-in-hack-claims-user-funds-are-safe(www.coindesk.com)
“[Scout] CoinDesk reports Bitget CEO Gracy Chen said $351.6 million was exposed to a system breach through unauthorized transfers from some hot wallets; she said cold wallets and user funds were safe, and withdrawals were paused temporarily pending a security review.”
— avoid-scout(unverified)
- https://news.bitcoin.com/zachxbt-bitget-supply-control-manipulation-rave-river-siren-lab-2026/(news.bitcoin.com)
“[Scout] Bitcoin.com reports ZachXBT accused Bitget of allowing market makers to run supply-control manipulation schemes, naming RAVE, RIVER, SIREN and LAB as examples, and alleged Bitget founder Shawn Liu is the key enabler behind CEO Gracy Chen.”
— avoid-scout(unverified)
- https://www.theblock.co/post/401290/zachxbt-alleges-95-insider-control-of-lab-token-in-investigation-into-ai-terminals-6-billion-fdv-project(www.theblock.co)
“[Scout] The Block reports on-chain investigator ZachXBT's claim that a market-maker operation behind the LAB token traces back to Bitget as the primary trading venue, with Binance and Gate as secondary channels. ZachXBT says a similar playbook was previously run with the tokens RIVER, RAVE, SIREN, MYX and SKYAI.”
— avoid-scout(unverified)
- https://news.bitcoin.com/zachxbt-bitget-shawn-liu-cex-cartel-2026/(news.bitcoin.com)
“[Scout] Blockchain investigator ZachXBT publicly alleged that Bitget operator Shawn Liu, whom he called 'the Bitget big boss who allows these scams to operate behind the scenes,' let market manipulation occur on the exchange. He pointed to the LAB token, saying wallets linked to its team moved about 96 million LAB tokens (~$63M) onto Bitget shortly before a sharp price surge, and named LAB founder Vova Sadkov as the alleged architect. Bitget and Liu had not responded at the time of publication.”
— avoid-scout(unverified)
11 submissions awaiting moderator review.
Timeline(18 events)
December 2021
Singapore's MAS suspends Bitget's local operations after the exchange promoted an unaffiliated 'Army Coin' tied to K-pop group BTS.
Benzinga26 December 2022
BitKeep (now Bitget Wallet) trojanized-app hack results in an estimated $8-9.9 million in losses.
The Hacker News / HalbornOctober 2023
Bitget delists TokenFi (TOKEN) days after listing it, citing suspected market manipulation; a public dispute with Floki over an alleged $10 million liability follows.
CoinDesk2023
Bitget's Hong Kong unit, BitgetX, winds down after the company decides not to pursue a Virtual Asset Trading Platform license.
Wikipedia1 April 2024
Alberta Securities Commission adds Canada Bitget Limited to its Investment Caution List.
Alberta Securities CommissionNovember 2024
Bitget relaunches in the UK after a pause tied to the FCA's financial-promotions regime.
CointelegraphFebruary 2025
Apple removes Bitget's app from its Japanese App Store at the FSA's request.
Gigazine / The Block20 April 2025
Bitget detects 'abnormal trading activity' on VOXEL/USDT futures and announces account rollbacks.
The BlockJuly 2025
Saskatchewan's FCAA issues an investor alert stating Canada Bitget Limited is not registered to trade or advise in securities or derivatives in the province.
Government of SaskatchewanAugust 2025
The Philippine SEC issues a public advisory naming Bitget among roughly ten exchanges operating without local registration; ISPs begin blocking access.
IDN FinancialsFebruary 2026
Bitget temporarily pauses new user onboarding in India, citing FIU-IND compliance requirements; existing users are unaffected.
Crypto TimesMarch 2026
Bitget ends services to French residents, exiting the French market ahead of the MiCA transition deadline.
CryptoastMay 2026
ZachXBT publishes allegations naming Shawn Liu as Bitget's true operator and alleging coordinated manipulation of the LAB token and others.
The Block / Crypto-Economy9 July 2026
The AMF removes bitget.com from its crypto-asset blacklist, after Bitget had already exited the French market.
AMFSeptember 2026
Bitget suffers a hot/warm wallet hack; losses reported between $351.6 million and $387.5 million, with analysts linking the intrusion to North Korea.
CoinDeskDecision Log
- slot 466966020 · hash FCa6WdMzbWiwk9F92B2wHwyK8CGfftAJKrepfz36isje
- slot 466365255 · hash ApgijXbf9Y1fxvJ5qkCgbfh2DrZF7ezpUvFxe1RNiieT
- slot 465625222 · hash BFU2qdmr5mqvvDCD9nmkELyXz4cf8CfgHhoXTbux13oi
- slot 465625220 · hash 5EE8Fsy1HPuYNZx294Ere7k7fPhthuqUUDjvSUxpBapB
- slot 465558071 · hash 26FAGKjcqGncp6bv63KCfCmyT7MwisLnRtZg3fbaEVTY
- slot 465558066 · hash 6SXA3tCHZFAr86MHiCDnAbTyi7bmMNR1JRgNuTwxsHsJ
- slot 465558055 · hash 7cAtXMPNjatDn2dNHdF4gqwE3BxPpBGNF8nAFhgHkG7g
- slot 465079847 · hash GR6niZbHEnPEz6TeTHYPxemzzE8N2tiQqUqWQZ2jitWz
- slot 465070655 · hash 5KEXL2EUJwjh1H1mvWGM87uNgbevGoNNh5C7Ha1AKi9X
- slot 465070639 · hash 9hfpGoJvT52Rspbu5CXPgnhNG1L2VPXACuShkZbWmJoN
- slot 465070035 · hash E2cYGQD2LATp33ygJy6524FAB8mXqMbJPuEXgFGsQ6Gc
- slot 465069270 · hash HHvcFCfpFwejCPPYXArcKKrpw8poPT9vcS3TdpNRGfer
- slot 465068088 · hash 3tCxtT9SMeGicVt9iSxaBrMWuAGtCYTn9YToF8FzzmtT
- slot 463205602 · hash GHCt9tjmvCQQLCq5DH753cdM96pbMvyF28DZL6bHk33T
- slot 462277246 · hash DP2CcRyMRJWKNYUFus5ccEPR8Cbk6QuhTPKXusU5stVr
- slot 462277241 · hash 2zogiGqqKqJAMkgGspGjgijFKEBjRvWjnkMBvU3tLM4H
- slot 461965689 · hash DZMcghJttiHAJwWi3rAHEFoHPthNMHmHyG2MFBqQi5NF
- slot 457704541 · hash HjpSUnWa5xLFpxQZynWQEvDUfUXo7CwZ7MPZWPdFfCa8
- slot 445607764 · hash AaQWSNwtyNY5dfAhNiFwZBwJHJ67DiuzTK2yncSE1Eop
- slot 443505668 · hash AZQ1etCpQDRxMQrwekfpofJ3raWQmfBx7Z3EaEZ2GnFS
This investigation is cryptographically anchored to the Solana blockchain (20 decisions). 47 of 56 cited source URLs have an Internet Archive snapshot.
model: claude-code-investigator
generated: 6/27/2026, 12:05:15 PM
last updated: 11/8/2026, 3:30:22 PM
21 viewsavoid.net — verified advice for a post-truth world