HTX (Huobi) hot wallet exploit hack — November 2023

On 22 November 2023 attackers drained hot wallets belonging to the exchange HTX, formerly Huobi, and at the same time attacked the HECO Bridge, the cross-chain bridge connecting HTX's Heco Chain to Ethereum. Justin Sun, HTX's de facto owner, confirmed both on X the same day, writing that HTX would fully compensate for the hot wallet losses and that deposits and withdrawals had been suspended pending investigation.

The two losses are normally counted separately and this record covers the exchange side only. An HTX representative told the South China Morning Post that about $30 million was taken from the exchange wallet. Cyvers, which raised the first alert, put the exchange-side figure at $13.6 million, listing 1,240 ETH, 7.3 million USDT, 1.78 million USDC and 62,200 LINK moved out of three compromised hot wallets and swapped into ether. The amount recorded here is the exchange's own account, with the lower on-chain estimate as the bound. The HECO Bridge lost a further sum reported at between $83.4 million and $86.6 million, which is not included in this figure. Elliptic later put the combined HTX and HECO theft at $112.5 million.

HTX restored deposits and withdrawals for major assets within days and said the loss was small relative to its holdings. Neither the exchange nor Sun published a technical post-mortem, so the entry point remains unexplained publicly.

Elliptic attributed the theft to North Korea's Lazarus Group on the basis of the attack's characteristics and the later movement of funds, and reported that more than $100 million in ether from the HTX and HECO thefts was pushed through Tornado Cash starting on 13 March 2024. No government has formally attributed the incident.