What happened
Around 1 a.m. GMT+8 on June 27, 2019 (June 26 UTC), an attacker stole 9.3 million XRP and 2.5 million ADA from Singapore-based exchange Bitrue. At the time, estimates put the haul at $4.2-4.7 million, and Cointelegraph's headline said $5 million.
Bitrue said a single attacker exploited a flaw in its Risk Control team's second review process to reach the funds of about 90 users, then used that access to get into the exchange's hot wallet. Roughly half the loot went to private wallets and half to five exchanges. Huobi, Bittrex and ChangeNOW froze about $1.35 million of it.
Bitrue shut the exchange down within about 30 minutes and involved Singapore authorities. It said the affected users' funds were insured and would be replaced, and it put its net loss after the freezes at about $3.15 million. That figure was $1.89 million from user accounts and $1.26 million from the hot wallet.
How it happened
- The attacker exploited a flaw in the second review step of Bitrue's Risk Control process. Bitrue has not published technical details of that step. This gave access to the personal balances of about 90 users.
- Using what that first access taught them, the attacker reached Bitrue's hot wallet.
- They withdrew 9.3 million XRP and 2.5 million ADA. About half went to private wallets and half to Huobi, Bittrex, ChangeNOW, Exmo and Coinswitch.
- Bitrue detected the activity and suspended the platform. Huobi, Bittrex and ChangeNOW froze about $1.35 million of the stolen funds.
Protocol details
Funds Recovery
Recovered
$5.0M
Net Loss
$0
Evidence
- report @BitrueOfficial incident report twitter.com
- report Report bithomp.com
- analysis Singaporean Exchange Bitrue Gets Hacked, Losing $5 Million in XRP, Cardano cointelegraph.com
- analysis DeFiLlama defillama.com
- analysis Hackers breach cryptocurrency exchange Bitrue for $4.2M in Ripple and Cardano thenextweb.com
- analysis Crypto Exchange Bitrue Hacked, $4.5 Million Worth Crypto Stolen financemagnates.com
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
