Heco Bridge Hack

REPORTED LOSS $86.6M
High Private Key Compromised (Unknown Method) ethereum

What happened

The Heco Bridge and related HTX infrastructure were drained on 22 November 2023. Blockchain-security reporting estimated about $86.6 million moved from the Heco bridge, after which HTX suspended services and pledged to cover losses.

Technical Root Cause

Public incident coverage consistently describes a hot-wallet or bridge-key compromise, but does not establish the specific credential or infrastructure entry point. Treat the exact root cause as unknown.

Case & protocol details

Classification Infrastructure / Key Compromise

How it happened

  1. Unauthorized transfers moved bridge-held assets to an external address.
  2. The assets were exchanged across chains and wallets after the withdrawals.
  3. HTX/Heco halted operations and began a recovery and reimbursement response.

Evidence & learning

Attack pattern

Compare incidents →
Access Control Attacks

Sources and on-chain records

Browse all hacks

Other incidents recorded with the same attack technique.

Huobi $26.4M
CoinSpot $2.4M
KuCoin $285M

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes