XT.com hack — November 2024

On 28 November 2024 the Seychelles-registered exchange XT.com suspended withdrawals after an unauthorised transfer emptied part of its hot wallet holdings. Blockchain security firm PeckShield flagged the outflow, and XT.com then acknowledged what it described as an abnormal transfer from its platform wallet.

The attacker took a mixed basket of tokens, including thinly traded assets such as FLOKI and MAGA, and consolidated them into 461.58 ETH, routing funds through the Optimism and Polygon bridges into Ethereum. Merkle Science, which traced the movement, noted that XT.com continued using the affected wallet rather than migrating the remaining balance, and speculated that the breach may have been internal rather than an external compromise. Halborn's assessment was that a compromised private key giving access to the hot wallet was the most likely cause. XT.com never published a root cause.

The reported loss is consistent across sources at about $1.7 million, spread over roughly twelve token types. Merkle Science later observed the attacker's consolidation address holding close to $1.9 million, mostly ETH, but that reflects a later valuation of the wallet rather than a larger theft.

In a subsequent statement XT.COM said the assets involved belonged to the platform and that user accounts were unaffected, and it has said it holds reserves 1.5 times user balances. Withdrawals were gradually restored. No funds are known to have been recovered and no one has been charged.