HTX Hack

Reported loss $8.0M
Ethereum
Private Key Compromised (Unknown Method)

What happened

On September 24, 2023, an attacker withdrew 4,999 ETH (about $7.9 million) from a hot wallet of HTX, the exchange formerly called Huobi Global. The funds went out in transaction 0xe9eefff04322a1e9262aad139e7b03954709a7c2ffea5ba9d1026a24fb58c029 to 0xdb1D74467c9042517A354304256E0d658D8AEC83, and part was later moved to 0x799982b75Ba538F211871cBa50Fa1A42ADa9ab5E. Justin Sun said the next day that HTX had fully covered the loss and trading was unaffected. HTX sent the attacker an on-chain message offering to let them keep 5% as a white hat bounty, and Sun also offered them a job as a security advisor.

On October 7, 2023, the attacker returned the ETH in two transfers of about 1,000.9 and 3,997.9 ETH. The second carried a note saying HTX's system hot wallet private key had leaked and advising the exchange to change the hot wallet address. The same day HTX paid a 250 ETH (about $410,000) bounty and asked for a vulnerability analysis. HTX has not published how the key leaked.

Protocol details

Classification Infrastructure / CeFi / Key Compromise
Protocol Type CEX
Affected asset / contract HT
Protocol links Website @HTX_Global

Funds Recovery

98.9%

Recovered

$7.9M

Net Loss

$88,000

Post-Incident Timeline

  • 2023-10-07

    The hacker returned all stolen funds

Evidence

Proof of concept

1 available

Sources

Understand the attack patterns

Compare incidents →
Access Control Attacks

Same attack technique

Browse all hacks →
BtcTurk $54.0M lost Arbitrum CoinEx $55.0M lost Ethereum Vulcan Forged $140M lost Ethereum Roll $5.7M lost

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes