Trade.io Hack

On October 20, 2018, Trade.io's security team spotted a large outgoing transaction from a cold wallet holding 50 million of its Trade Tokens (TIO). The wallet was a password-protected hardware device kept in a bank safety deposit box, and it held the company's reserve for the exchange's liquidity pool. The tokens were worth about $11 million at the time of the theft and about $7.5 million within hours, as the TIO price dropped. Decrypt later reported that TIO fell roughly 40%, from about $0.22 to $0.13.

The thief moved about 1.3 million TIO (around $197,000) to KuCoin and Bancor before the exchanges were alerted. KuCoin and Trade.io suspended TIO trading, Bancor quarantined the transactions and delisted the token, and Trade.io said no customer accounts or funds were affected. Trade.io said the deposit boxes were intact and its investigation found no technical hack of the cold storage unit and no sign of insider theft, so how the wallet was accessed was never explained. The company then forked the token into Trade Token X (TIOx), an ERC-20 replacement meant to leave the stolen TIO worthless.