Bitget's hack and blocks: what they say about keeping money on an exchange
In three weeks Bitget gave two reasons to think about where your money sits. We went through both events from primary sources and wrote a piece.
A hack in which no keys were stolen
- On 24 September $351.6M left the exchange, later revised to roughly $387.5M. The funds went out across seven networks, the largest share in XRP at about $158M.
- Private keys were not stolen and cold wallets were untouched. The attacker got into the backend and spoofed the transaction data that the authorization system saw. Someone else's withdrawals passed the standard approval as legitimate. There is no defence from the user's side: the intruder needs neither your password nor your two-factor check — he is not deceiving you.
The block list is wider than three countries
- On 16 October Russia and Belarus were added to the prohibited jurisdictions, Kazakhstan had been there before. The list names
28 jurisdictions in all, among them Japan, Canada, France, Germany and the United States — this is just as much about regulated markets the exchange will not enter without a licence.
- Five days for everything. From 18 October no new trades, by the 21st positions must be closed and funds withdrawn, from the 21st login is restricted. Getting round it with a VPN is banned in a separate clause.
What self-custody does not solve
This part usually goes unwritten, and it matters more than the rest.
- Bitget's users lost no money. The loss was covered by the protection fund, which holds more than $464M. Somebody who loses their secret phrase or signs a malicious transaction has no fund, no undo and no support.
- Geography limits wallets too. In Rainbow itself the Cash section works only for customers in the United States, excluding New York and California, and only with a Visa card.
Self-custody shifts the risk rather than removing it: from the counterparty to you. It is a choice of which risk to carry, not "one is better than the other".
On the token — also without varnish
Rainbow buys RNBW back off the market, and we measured it: more than 20 million tokens between February and October, with market orders, paid in USDC. The treasury address and the monthly breakdown are in the piece. But no obligation to buy back is fixed on chain, and the claim that "the company buys the token back out of a share of its fees" describes a mechanism that does not exist there.
The full piece — rnbw.wiki/en/articles/bitget-hack-blocks-self-custody-wallet
What is changing in the wallet's code — at rnbw.wiki/pulse
$RNBW #RNBW