AscendEX hack — December 2021

AscendEX, a Singapore-based exchange formerly called BitMax, identified unauthorised transfers from one of its hot wallets on 11 December 2021, detected at around 22:00 UTC. The exchange's own incident report says an individual or group "gained unauthorized passthrough access to AscendEX's hot wallet infrastructure" and initiated transfers on the Ethereum, Polygon, Binance Smart Chain, Litecoin and Bitcoin Cash networks; its earlier follow-up announcement also listed xDai addresses. An internal audit identified the breach as "the result of an exploit of hardware-level vulnerability from third-party infrastructure utilized by AscendEX." The vulnerability itself was never described.

AscendEX never published a loss figure. The widely cited estimate comes from PeckShield, which put the total at $77.7 million — roughly $60 million on Ethereum, $9.2 million on Binance Smart Chain and $8.5 million on Polygon — reported by CoinDesk and Cointelegraph on 12 and 13 December 2021. Headlines quoting $80 million round the same estimate. Stolen assets spanned dozens of ERC-20 tokens including USDT, USDC and SHIB. Cold wallet reserves were not affected.

The exchange suspended deposits and withdrawals, moved unaffected assets to cold storage, and encouraged affected token projects to migrate contracts. Five did so — Zignaly, Bemil Coin, Gather, BTC Proxy and Aubit — which AscendEX said recovered over $10 million. Deposits and withdrawals reopened from 03:00 UTC on 16 December 2021 on entirely new hot wallet infrastructure, with new deposit addresses for every account. AscendEX stated it had reimbursed 100% of impacted users. No attacker has been publicly identified.