HTX and Heco Bridge hack — November 2023

On 22 November 2023 the operator key controlling the Heco Bridge, the cross-chain bridge linking Ethereum to the Heco chain, was compromised, and hot wallets at the HTX exchange, formerly Huobi, were drained in the same operation. Both are associated with Justin Sun. CertiK's analysis found the attacker called the bridge's withdrawToken function, which only the operator address can invoke, and moved about $87 million out of the bridge on Ethereum: 10,145 ETH, 42.11 million USDT, 489 HBTC, 173,200 UNI, 42,399 LINK, 619,000 USDC, 346,994 TUSD and a large SHIB position. HTX's own wallets lost about $13.6 million on Ethereum and about $12.6 million on Tron, plus roughly 74 BTC.

HTX said in a statement that assets worth about $30 million in its hot wallet were affected, that it had temporarily suspended deposit and withdrawal services on both the HTX platform and the Heco Chain gateway, and that it would fully compensate for any losses incurred due to the hot wallet attack. Services were restored over the following days.

Reported totals for the combined event differ modestly. CertiK put it at about $113.3 million. CNBC's figure of about $115 million combined HTX's own $30 million with CryptoQuant's estimate that $85.4 million was taken from Heco, largely in USDT and ether. A CryptoQuant analyst told CNBC the attacker was converting into ether because USDT and USDC can be frozen by their issuers.

The exchange and bridge losses were one operation and are recorded here as a single incident. No funds were returned, no arrests have been reported, and neither HTX nor CertiK attributed the compromise to a named actor.