BitoPro hack — May 2025

BitoPro, a Taiwanese cryptocurrency exchange, lost roughly $11.5 million from hot wallets on Ethereum, Tron, Solana and Polygon. Published dates differ by a day: the outflow transactions are dated 8 May on-chain, while accounts based on the exchange's own description place the incident at about 01:00 on 9 May 2025 Taipei time.

BitoPro said attackers used social engineering to plant malware on the device of an employee who managed its cloud operations. The malware evaded the company's antivirus, endpoint protection and cloud security detection, and the attackers hijacked AWS session tokens to bypass multi-factor authentication, then linked the AWS environment to a command-and-control server that issued instructions to the hot wallet systems while simulating legitimate wallet operations. The access was exploited during a scheduled hot wallet system upgrade and asset transfer operation. BitoPro said no internal personnel were involved and that the matter had been handed to criminal investigation units.

BitoPro did not publish a loss figure. The $11.5 million estimate comes from on-chain analyst ZachXBT, who flagged the outflows publicly on 2 June 2025 — 25 days after the incident and before the exchange had said anything — and traced funds into Tornado Cash and across Thorchain into Bitcoin and then Wasabi. Some reporting rounds the total to $11 million. BitoPro said it replenished the affected wallets from its own reserves and that no user funds were affected. An external cybersecurity firm commissioned by BitoPro concluded the methods bore hallmarks consistent with past Lazarus Group operations; no government body has attributed the theft.