OlaXBT hack — September 2025

On 1 September 2025 roughly 32 million AIO tokens were withdrawn without authorisation from multisig wallets controlled by OlaXBT, a BNB Chain project marketing an AI trading agent built around the Model Context Protocol. The tokens were moved to a single address, and sold on-chain. Two blockchain security firms flagged the movement separately the same day. CertiK reported the withdrawals from the multisigs to that address and the subsequent sales, putting the value at over $2 million. HashDit said the project had been compromised, that AIO had been drained from the multisig wallets and sold on-chain, and that proceeds worth at least $2 million were sent to accounts at KuCoin and Bitget. Both figures are floors rather than reconciled accounting, and no party has published a final total. OlaXBT confirmed the unauthorised withdrawals in a statement the same day and said it was preparing a compensation plan for verified holders who held AIO before the incident. It subsequently announced a swap to a new token contract at a 1:1 ratio, and Gate suspended AIO deposits and withdrawals while it supported the swap. The mechanism behind the multisig withdrawals remains undisclosed. Descriptions of the incident as a social-engineering attack circulate but are not supported by any statement from the project or from CertiK or HashDit. No funds have been reported recovered, no arrests have been announced, and there is no public confirmation that the compensation plan was completed.