Kronos Research hack — November 2023

Kronos Research is a Taipei-based quantitative trading and market-making firm. On 18 November 2023 an attacker who had obtained some of the firm's exchange API keys used them to move funds out of its trading accounts. Kronos disclosed the breach on X the following day, saying unauthorised access to its API keys had occurred and that it had suspended trading while it investigated.

CertiK's analysis put the loss at 13,008 ETH, approximately $26 million, consolidated on Ethereum and split across six wallets. It traced the activity to withdrawals totalling 22,899,712 USDT from Binance over about three hours, starting with a 72 USDT test transaction at 16:47 UTC that CertiK read as the attacker confirming control, and found the attacker also reached about $2 million in WOO tokens plus roughly $107,000 in WBNB and $82,000 in BNB on BNB Chain. The independent investigator ZachXBT, who mapped the outflows separately, estimated over $25 million. Kronos itself put the figure at approximately $26 million, the number recorded here.

The credentials involved were API keys issued by trading venues, not blockchain private keys, so the attacker never needed control of a wallet: the withdrawals were authorised by the exchanges as though Kronos had requested them. Kronos has not published a technical account of how the keys were taken.

The firm said the potential loss was "not a significant portion of our equity", that all losses would be covered internally and that no partners would be affected. It paused trading, audited its systems and later resumed spot and perpetual trading and withdrawals. No funds have been publicly reported as recovered, no arrests have been announced, and no named source has attributed the theft to a specific actor.