M2 Exchange hack — October 2024

On 31 October 2024 at about 03:16 local time (UTC+4), attackers drained hot wallets belonging to M2, an Abu Dhabi-based exchange and custodian licensed by the ADGM Financial Services Regulatory Authority. Roughly $13.7 million in customer assets was taken in a coordinated sweep that hit wallets on Bitcoin, Ethereum and Solana at the same time.

M2 said it contained the incident within 16 minutes, at 03:32, and published a notice stating that "the situation has been fully resolved and customer funds have been restored", adding that it had "taken full responsibility for any potential losses". The exchange did not disclose how the wallets were compromised and published no technical post-mortem. The security firm QuillAudits described the event as an access-control failure in M2's hot wallet infrastructure, but framed that as an inference rather than a confirmed cause. The simultaneous loss of wallets on three unrelated chains is the only concrete signature available publicly.

Customer balances were made whole out of M2's own reserves, not by recovering the stolen assets. Blockchain investigator ZachXBT flagged the theft publicly, and the analytics firm Cyvers traced the flows, reporting that the proceeds were consolidated into ether and that around $10 million was still sitting unmoved in attacker-controlled Ethereum addresses several days later.

The $13.7 million figure is consistent across all reporting and was not disputed. No actor has been named and no arrests have been reported. The speed of the stated resolution and the absence of any technical account drew scepticism from researchers at the time.