Heco Bridge hack — November 2023

On 22 November 2023 the Heco bridge, which moved assets between HTX's Heco chain and Ethereum, was emptied in a rapid sequence of withdrawals. PeckShield's total for the outflow came to $86.6 million. An itemisation reported alongside it included roughly 10,000 ETH, 42 million USDT, 489 Heco-pegged BTC, about 350 million SHIB, 173,200 UNI, more than 40,000 LINK, $619,000 USDC and $346,994 TUSD. Cyvers put the bridge loss at about $85 million and other reporting at about $87 million. The proceeds were converted to ether and distributed to externally owned accounts.

No contract flaw has been identified. The withdrawals were signed by the bridge's own operator account, which security firms read as a compromised operator that had been in use since October 2022. PeckShield's initial public assessment was hedged, saying the bridge may have been exploited or rug-pulled, and HTX has never published a technical post-mortem, so the private-key explanation rests on third-party analysis rather than disclosure. Shortly afterwards, transfers with the same signature pattern drained a hot wallet at the HTX exchange itself. Wintermute's head of research counted $23.4 million there, while other accounts of the exchange-side loss range from about $12.4 million to $30 million, which is why same-day totals for the two incidents combined are variously reported between roughly $97 million and $111 million.

Justin Sun, who controls both HTX and the Heco ecosystem, confirmed the attacks the same day, suspended deposits and withdrawals, said HTX would fully compensate any losses originating from the exchange and that all funds on HTX were secure, and resumed services within about a day. The stolen ether sat untouched for months; in March 2024 Elliptic tracked about $12 million of it through Tornado Cash in more than forty transactions over roughly a day, and attributed both the laundering and the original hack to North Korea's Lazarus Group. No government has formally confirmed that attribution.