Bitget Wallet COO says: Self-custody must make asset ownership safer

Bitget Wallet COO Alvin Kan calls for clear transaction rights and wallet recovery controls

After the Bitget exchange reported a $387.5 million security breach, Bitget Wallet chief operating officer Alvin Kan called for the establishment of clearer transaction rights and wallet recovery controls. He emphasized that direct ownership of assets must be accompanied by security measures that users can understand.

Kan pointed out that sharing signature and management systems could put many users at risk of the same security vulnerability. Bitget Wallet said its independent self-managed service was not affected by the exchange incident. Kan believes that wallet developers should clearly state spending and restoration rights, while European regulators and the U.S. Securities and Exchange Commission (SEC) are also reviewing custody controls through their respective regulatory initiatives.

Self-hosting aims to reduce the impact of a single failure

Alvin Kan said in an exclusive interview with crypto.news that self-hosting should reduce the losses caused by a single security failure without requiring users to become security experts. He pointed out that while allowing users to control assets, it also puts more responsibility on the wallets, devices and users 'decisions. Kan said wallet developers must incorporate these risks into product design, including how to get users to approve payments and regain access after losing the device.

According to a statement issued by the company, Bitget Wallet was not affected by the exchange incident. The company describes Wallet as an independent self-managed service in which users retain control of assets on their chain.

The core risk of centralized hosting lies in the "radius of explosion"

For Kan, the core of the centralized hosting problem lies in how many people may be affected when a shared system fails. He said large asset pools that rely on co-signatures or management controls could expose multiple users to the same security vulnerability. "Recent security incidents have taught us that custody risks are ultimately about the 'blast radius'." Kan said.

He argued that exchanges and self-custodial wallets should not be seen as competing solutions to meet all financial needs, but rather allow users to directly own assets while limiting the consequences of any single point of failure.

Review of the Bitget Exchange Incident

A report released on September 28 on Bitget's restart of withdrawals detailed the exchange's description of how attackers obtained advanced internal credentials through vulnerabilities in third-party security products. Bitget said the certificates allow fraudulent withdrawal orders to bypass existing controls.

According to the exchange, the September 24 incident affected parts of its hot wallet and warm wallet infrastructure, while cold wallet remained secure and private keys were not compromised. Bitget revised its original estimate of losses of $351.6 million to approximately $387.5 million.

The exchange stated that after completing security checks, Bitcoin withdrawals were reopened at 08:00 UTC on September 28. In the same update, Bitget said user account balances were not affected, its user protection funds would cover financial losses, and Mandiant and SlowMist were assisting in the investigation.

Clear approval and restoration rules reduce self-custody risks

Kan said that before a user signs, the wallet should clearly state how much funds will be transferred out and whether the operation authorizes a single payment or allows the application to subsequently transfer funds. In his view, users also need a simple way to revoke granted permissions. "Undecipherable warnings provide little protection." Kan said.

On access recovery, he called for an equally clear explanation of what happens when a device or backup is lost. According to Kan, users should know who can help restore access rights and the scope of rights each party has. "Easier access should not quietly re-establish the kind of centralized control that self-hosting is designed to avoid."

Beyond asset storage: The future role of self-managed wallets

Kan predicts that self-managed wallets will become the norm as accounts become increasingly popular with the ability to receive funds, hold balances, make payments, and access investments. He attributes this expectation to users 'need to provide these services in one interface while maintaining control of assets.

He said that exchanges still serve trading, liquidity and fiat access needs, but using these services should not require customers to entrust all assets to the exchange. He describes his ideal custody model as "owning assets directly, supplemented by services people choose to meet specific needs."

ESMA's custody review tests transaction controls and external suppliers

欧洲的监管工作已经涵盖了Kan提出的若干运营问题。7月11日的报道审查了欧洲证券和市场管理局（ESMA）的加密托管韧性审查，其中包括密钥管理、交易控制以及对外部技术提供商的依赖情况。

ESMA在7月8日的公告中表示，此次审查将评估治理、密钥和存储管理、事件检测与响应、智能合约风险以及第三方依赖关系。监管机构称，国家当局将对获授权的加密资产服务提供商的风险样本进行检查。ESMA表示，这项工作将从2026年下半年持续到2027年上半年。其公布的时间表显示，最终报告将于2027年下半年提交至监督委员会。

在事件响应方面，Kan呼吁更快地共享威胁情报，并协调努力追踪被盗资产。他说，预防和响应都需要改进，而不是让用户负责理解每一个安全威胁。

一份10月2日关于被盗Bitget资金流向的报告引用了BlockSec的发现，即攻击者迅速将发行人可以冻结的资产转换为其他形式，跨链转移价值到比特币，并将部分BTC发送进入CoinJoin交易。BlockSec的分析基于公开的攻击者地址和9月29日的快照。

SEC提案将机构自我托管单独分类

对于使用顾问或受监管基金的美国投资者，SEC提出了不同的托管框架。10月3日的报道详细介绍了该机构于10月1日发布的有条件加密托管提案，针对投资顾问和受监管基金，包括注册投资公司和发展公司。

委员Hester Peirce在10月1日的声明中解释称，机构的“自我托管”意味着顾问为客户持有资产。她将这种安排与个人投资者在没有中介的情况下自行保管资产区分开来。

根据Peirce对该提案的描述，顾问首先需要确定没有可用的许可托管人来托管该资产，并每季度重复此评估。对于州信托公司托管，她说顾问和基金在被任命前需评估州授权和书面保障措施，然后每年重复这些检查。

根据SEC的规则制定档案，这些变更仍是拟议规则，公众可在《联邦公报》发布后的60天内提交评论，文件编号为S7-2026-35。

披露：本文不代表投资建议。本页展示的内容和材料仅供教育目的。