What happened
On November 22, 2023, suspicious transfers drained assets from HTX hot wallets while the Heco Bridge was attacked separately. HTX temporarily restricted services while it investigated and said it would compensate hot-wallet losses. A CertiK analysis identified about $13.6 million of Ethereum-side HTX transfers to likely attacker-controlled addresses, plus additional suspicious activity on TRON.
How it happened
The incident affected centralized custody wallets rather than an HTX smart contract. CertiK traced transfers of ETH, USDT, USDC, LINK and other tokens from HTX hot wallets to externally owned addresses, followed by HTX recovery activity. Its analysts treated the hot-wallet and Heco Bridge events as part of a private-key-compromise episode, but HTX's public notice did not disclose the access path.
Protocol details
Evidence
- report @CyversAlerts incident report twitter.com
- analysis Web Archive archive.ph
- analysis HTX notice on the November 22 cyberattack htx.com
- analysis Heco Bridge Exploit certik.com
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
