Bilaxy Hack
MERKLE SCIENCE ESTIMATE
—
What happened
Bilaxy's Ethereum token hot wallet was compromised on August 28, 2021. Bilaxy reported approximately 295 token balances affected; Merkle Science counted 297 assets including ETH and estimated their value at about $30 million. These counts and valuations differ from initial reports.
Technical Root Cause
Unauthorized hot-wallet transfers are established, but the reviewed analysis does not reveal whether a stolen private key or another compromise of signing infrastructure enabled them.
Case & protocol details
Classification
CeFi / Access Control
Protocol Type
Exploit/Access control
Affected asset / contract
BIA
Official Website
bilaxy.com/
Protocol Twitter/X
@Bilaxy_exchange
How it happened
- Tokens left Bilaxy's hot wallet between 18:00 and 19:00 UTC for an attacker-controlled address.
- Bilaxy warned users not to deposit and began investigating and rebuilding its systems.
- Merkle Science traced 200 ETH to Tornado Cash. Its September 1 analysis still found substantial assets in the destination wallet.
Evidence & learning
Attack pattern
Compare incidents →Sources and on-chain records
- report Report blog.merklescience.com
- report Report pymnts.com
- report Report cointelegraph.com
- analysis Hack Track: Analysis of the Bilaxy Hack merklescience.com
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
