Incident Overview
On July 24, 2025, crypto trading platform WOO X experienced a cybersecurity breach affecting 9 user accounts, resulting in approximately $14 million in unauthorized withdrawals. The incident was contained within hours, and WOO X committed to fully covering all losses while temporarily pausing withdrawal services for additional security measures.
The exploit originated from a targeted phishing attack that compromised a team member's device, allowing the attacker to gain access to WOO X's development environment. Despite multiple security measures limiting access, the exploiter had sufficient time to coordinate a series of unauthorized withdrawals from the affected user accounts. The attack began at 13:50 UTC+8 with the first withdrawal request, with subsequent requests coming in gradually until the exploit was discovered and halted at 15:40 UTC+8.
The incident was quickly contained, with many withdrawal attempts blocked by the platform's security systems. WOO X completed a full forensic review and restored all affected account balances from their company treasury within 24-48 hours, confirming that no WOO tokens were stolen or sold during the compensation process.
Ethereum Addresses:
Bitcoin Addresses:
bc1q4xm6y972qa82f4cudr4d28xdhxa4e68v5atrej
bc1qut0g2uflywfcycuftuek7944p6hhxgm2p92fzm
Incident Report
Protocol Information
What the Attacker Needed to Succeed
Understanding the prerequisites for this type of attack helps auditors identify protocols that are most at risk and helps developers build better defenses.
What Auditors Should Check
If you're auditing a protocol with similar architecture to WOO X, these are the critical security checks that could have prevented this incident (July 2025).
- Verify all logic paths related to Social Engineering / Phishing are guarded by proper access controls and input validation - see the Phishing Attacks attack class for patterns
- Review privileged functions (owner, admin, governance) for potential abuse vectors - centralization risks should be documented and bounded with timelocks or multi-sigs
Master these auditing techniques with hands-on labs and real exploit scenarios in the Smart Contract Hacking course.
Free TrialRelated Attack Classes
The technique used in this hack maps to these vulnerability classes in our security curriculum:
Sources & References
- 01
-
02
Web Archive https://woox.io/
- 03
- 04
- 05
Learn to Prevent the Next WOO X
The WOO X hack is one of many attacks that skilled auditors are trained to detect before deployment. Master real exploit patterns and defense techniques with hands-on Web3 security training.