HECO Hack

Reported loss $86.3M
Ethereum
Compromised operator key and privileged withdrawal

What happened

HECO's Ethereum bridge was drained on November 22, 2023 for approximately $86.6 million. The incident involved a compromised bridge operator account, not a permissionless bridge-contract flaw. Same-day HTX hot-wallet activity is a separate loss category and is not included in this page's amount.

Technical root cause

Operator authority was the bridge custody boundary. Once the operator account was compromised, its privileged withdrawal calls were valid under the contract's access-control rules. Bridge operations need threshold key custody, isolated signer infrastructure, withdrawal caps and delays, plus monitoring and circuit breakers for anomalous releases.

How it happened

  1. The attacker used the compromised operator account to call the bridge's operator-gated withdrawal functions on Ethereum.
  2. Because the onlyOperator check accepted the compromised credentials, the bridge released native ETH and ERC-20 assets to attacker-controlled addresses.
  3. The assets were then swapped and distributed.
  4. The available evidence does not disclose how the operator credentials were compromised.

Protocol details

Classification Bridge Custody / Compromised Operator Authority
Protocol Type Exploit/Access control
Category Bridge Hack
Protocol links @HECO_Chain
Attacker Address 0xfc146d1caf6ba1d1ce6dcb5b35dcbf895f50b0c4
Exploit Transaction 0xbb6fe88427c2f3bc17…11873e131b

Evidence

Understand the attack patterns

Compare incidents →
Access Control Attacks

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes