HTX Hack

REPORTED LOSS $8.0M

Medium Sep 25, 2023 Private Key Compromised (Unknown Method) ethereum

What happened

Quick Summary

HTX Global's hot wallet was exploited, resulting in the theft of 4,999 ETH (approx. $7,902,519 USD) due to an access control vulnerability.

Details of the Exploit

On September 24, 2023, HTX, a cryptocurrency exchange platform, previously known as Huobi Global, suffered an exploit due to an access control issue. The attacker gained access to the exchange's hot wallet and withdrew 4,999 ETH, worth approximately $7,902,519 USD. The stolen ETH was transferred to the attacker's wallet in a single transaction, and 1,000 ETH was later sent to a second wallet.

As of September 27, 2023, the stolen amount remains in the provided addresses. HTX sent an on-chain message to the attacker, offering a 5% white hat bounty and disclosing their true identity. Justin Sun, CEO of HTX, announced that the exchange has fully covered the losses and resolved all related issues.

Block Data Reference

Attacker Addresses:

https://etherscan.io/address/0xdb1D7446…8AEC83

https://etherscan.io/address/0x799982b7…a9ab5E

Malicious Transaction:

https://etherscan.io/tx/0xe9eefff0…58c029

On-chain Message from HTX:

https://etherscan.io/tx/0x87f21652…7f863b

Case & protocol details

Classification Infrastructure / CeFi / Key Compromise

Protocol Type CEX

Affected asset / contract HT

Official Website www.huobi.com/en-us/

Protocol Twitter/X @HTX_Global?s=20

Funds Recovery

98.9%

Recovered

$7.9M

Net Loss

$88,000

Post-Incident Timeline

2023-10-07

The hacker returned all stolen funds

Evidence & learning

Attack pattern

Compare incidents →

Access Control Attacks

Proof of concept

1 available

Code HCT Price Manipulation

Sources and on-chain records

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes