Kronos Research Hack

Reported loss $26.0M
Ethereum BNB Chain
Compromised API credentials

What happened

Kronos Research suspended trading on 18 November 2023 after reporting unauthorized access to its API keys. CertiK traced withdrawals and subsequent consolidation worth approximately $26 million. This was an exchange-account incident involving the trading firm's credentials, not a demonstrated vulnerability in a DeFi smart contract.

Technical root cause

Compromised API credentials enabled unauthorized account access. API credentials are distinct from blockchain wallet private keys; the reviewed evidence does not establish the initial compromise method or a specific withdrawal-control bypass.

How it happened

  1. Kronos reported compromised API access and paused trading to investigate.
  2. CertiK identified a 72 USDT withdrawal from Binance at 16:47 UTC, followed roughly 15 minutes later by a much larger transfer. The small transfer may have been a test, but that interpretation is not confirmed.
  3. Further withdrawals occurred over several hours. CertiK traced assets on Ethereum and BNB Smart Chain and consolidation into approximately 13,008 ETH across six wallets.
  4. The public analysis does not establish how the API credentials were obtained or the exact exchange-account permissions and controls used to remove funds.

Protocol details

Classification Exchange-account security
Protocol Type Trading firm

Evidence

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes