Crypto exchange HTX sees over $258M outflows after exploit

Stock Photo – hbg-prod-fed-public.hbfile.net

HTX, a crypto exchange with ties to Grenadian entrepreneur Justin Sun, has experienced a $258 million net outflow after reopening following a hacking incident in November.

DefiLlama data indicate that funds were withdrawn between the exchange’s restart on November 25 and December 10, suggesting that customers were concerned about the security incident from the previous month. HTX reported a $30 million loss in crypto tokens due to the breach and temporarily stopped withdrawals and deposits after the attack.

In the same month, the Poloniex exchange, another exchange with links to Sun, and the HECO Bridge, a network created by HTX for blockchain transfers, also suffered hacker attacks. The incidents resulted in the loss of around $200 million in cryptocurrency.

Following these events, Sun revealed in a post on X that an investigation was ongoing and assured that the exchange would “fully compensate for HTX’s hot wallet losses.” Hackers had previously stolen $8 million from the platform in September.

“HTX and Heco Cross-Chain Bridge Undergo Hacker Attack. HTX Will Fully Compensate for HTX’s hot wallet Losses. Deposits and Withdrawals Temporarily Suspended. All Funds in HTX Are Secure, and the Community Can Rest Assured. We are investigating the specific reasons for the hacker attack. Once we complete the investigation and identify the cause, we will resume services,” said Sun.

Based on CoinMarketCap’s data, HTX is among the top 20 crypto exchanges, boasting an average trading volume of $1.6 billion as of December 10.

HTX’s largest portion of reserves, approximately 33 percent, is in Bitcoin, according to DefiLlama. Around 32 percent is in the TRX token from the Tron blockchain, which was introduced by Sun in 2017. HTX’s exchange coin HT represents roughly 14 percent, followed by a Sun-supported token called stUSDT at 12 percent.

Hackers steal $363 million in crypto in November

November was 2023’s worst month for theft, scams and exploits in the crypto sector, with criminals taking $363 million. Exploits led to losses of $316.4 million, flash loans caused $45.5 million in damage and exit scams claimed $1.1 million, as per CertiK’s data released on November 30.

In November, the biggest exploits happened on Poloniex and the HTX/Heco Bridge, resulting in losses of $131.4 million and $113.3 million, respectively. The third-largest exploit targeted a single victim who lost $27 million to a phishing attack.

This latest monthly total exceeded the previous record of $329 million, set in September, largely due to a $200 million attack on the Mixin Network.

By the end of November, approximately $1.7 billion had been lost to exploits, exit scams and flash loan attacks in 2023. This accounts for 54 percent of crypto drained in 2022, during which $3.7 billion was lost to crypto incidents. In 2021, losses amounted to $1.7 billion, as reported by CertiK.

Certik co-founder Ronghui Gu highlighted that simply having a standard smart contract audit is insufficient nowadays. He emphasized how threat actors keep discovering new methods to exploit protocols and victims. Recent security risks, such as SIM-swapping and multisignature vulnerabilities, are among the latest areas being exploited.