HTX hack — September 2023

About 5,000 ether left one of HTX's hot wallets on 24 September 2023 in a single unauthorised transfer. Merkle Science's flow-of-funds analysis records 5,000 ETH moving from the hot wallet to an attacker-controlled address and puts the loss at roughly $7.9 million; Halborn gives the figure as 4,999 ETH, also about $7.9 million. Justin Sun, the Tron founder who advises the exchange, described the loss publicly the following day as $8 million.

The cause was a compromise of the hot wallet's private key rather than any protocol flaw. The attacker confirmed as much in a message attached to one of the later return transactions, telling the exchange its system hot wallet private key had leaked and advising it to change the hot wallet address and reduce the proportion of assets held there. How the key was obtained has not been disclosed.

Sun said user funds were unaffected and that HTX would absorb the loss, setting $8 million against roughly $3 billion in user assets and calling it about two weeks of platform revenue. HTX then messaged the attacker's address offering a 5% white-hat bonus and no legal action if 95% of the funds were returned within seven days, a deadline falling on 2 October, warning that law enforcement would be involved otherwise. Sun publicly extended the offer to include a job as a security adviser. The deadline passed without a return.

The attacker sent the funds back on 7 October 2023 in two transactions of roughly 4,000 ETH and 1,000 ETH. Sun confirmed HTX paid the 250 ETH bonus, reported at the time as worth about $400,000. The gap between the $7.9 million and $8 million figures reflects both the small difference in the recorded token count and rounding at the September 2023 ether price.