{"investigation":{"slug":"bingx","entity_name":"BingX","trust_score":32,"severity_base":null,"score_modifier":0,"confidence":1,"status":"published","content_type":"investigation","summary":"BingX is a Singapore-headquartered centralized cryptocurrency exchange founded in 2018 (originally as Bingbon), operating across 160+ countries with over 10 million reported users. In September 2024, the exchange suffered a confirmed hot wallet breach totaling approximately $52 million across at least seven blockchain networks, with on-chain forensics subsequently linking the attack to North Korea's Lazarus Group. The exchange pledged full user compensation from reserves and resumed withdrawals within days, but independently unverified regulatory claims and initial opacity around the breach raise ongoing due-diligence concerns.","sections":[{"content":"BingX was founded in 2018 under the name Bingbon and rebranded to BingX in 2021. The exchange is incorporated in Panama and maintains offices in Hong Kong, Taiwan, Europe, and North America. Its founding team is described as drawing from financial institutions including J.P. Morgan and major technology companies including Google, Tencent, and Alibaba; however, key founders operate largely anonymously. Some sources identify Josh Lu as a co-founder. The platform offers spot trading, perpetual futures, copy trading, and grid trading services, and in 2024 announced a $300 million AI investment initiative and a sponsorship deal with Chelsea FC as the club's official crypto exchange partner. CoinMarketCap and CoinGecko list BingX among the mid-tier global exchanges by volume. The exchange reports serving more than 10 million users across 100+ countries.","heading":"Background","sources":[{"url":"https://bingx.com/en/about","name":"","type":"other","credibility":3},{"url":"https://www.crunchbase.com/organization/bingx","name":"","type":"other","credibility":3},{"url":"https://bitcoinwiki.org/wiki/bingx","name":"","type":"other","credibility":3}],"severity":"medium"},{"content":"On September 20, 2024, at approximately 4:00 AM Singapore time, BingX detected abnormal outflows from its hot wallets across multiple blockchain networks. The exchange initially described the event as 'temporary wallet maintenance' and suspended deposits and withdrawals, an act that drew public accusations of a cover-up. Chief Product Officer Vivien Lin later denied any intent to deceive, stating that immediate suspension and a neutral public label are standard emergency protocol while an investigation is underway. The initial loss estimate reported by BingX was approximately $26 million; however, independent blockchain security firms PeckShield, Cyvers, and SlowMist subsequently raised the figure to between $43 million and $52 million after tracing flows across all affected chains. BingX confirmed a final figure of approximately $52 million. Vivien Lin publicly pledged that all stolen customer funds would be reimbursed from the exchange's own capital reserves, and the exchange confirmed it had frozen approximately $10 million of the stolen assets in coordination with security partners. Full deposit and withdrawal services for major assets including BTC, ETH, USDT, USDC, TRX, and SOL were restored within approximately 48 hours; full restoration was expected within one to two weeks.","heading":"The $52M Hack","sources":[{"url":"https://www.dlnews.com/articles/markets/bingx-dismiss-hack-cover-up-restore-deposit-withdrawal/","name":"","type":"other","credibility":3},{"url":"https://www.coindesk.com/tech/2024/09/20/crypto-exchange-bingx-hacked-onchain-data-shows-over-43m-drained","name":"","type":"other","credibility":3},{"url":"https://www.halborn.com/blog/post/explained-the-bingx-hack-september-2024","name":"","type":"other","credibility":3},{"url":"https://blog.bingx.com/bingx-updates/ama-recap-with-bingx-cpo-vivien-lin-addressing-the-recent-hot-wallet-incident/","name":"","type":"other","credibility":3}],"severity":"medium"},{"content":"Blockchain security firm Cyvers was among the first to flag the anomalous outflows. Hakan Unal, Senior Security Operations Lead at Cyvers, noted that the attacker's pattern — using at least ten exploit addresses to drain funds across Ethereum, Binance Smart Chain, Base, Optimism, Polygon, Arbitrum, and Avalanche, then rapidly swapping altcoins into ETH and BNB before consolidating — is consistent with tactics documented in prior Lazarus Group operations. No definitive attribution to Lazarus Group was publicly confirmed at the time of the hack. However, in February 2025, blockchain investigator ZachXBT published on-chain analysis demonstrating that an address used in the BingX hack was directly connected to the same address cluster responsible for the Phemex hack and, subsequently, the Bybit $1.5 billion hack of February 2025. ZachXBT also linked Poloniex to the same cluster, tying four major exchange hacks to a single threat actor, widely understood to be Lazarus Group. PeckShield and SlowMist independently tracked the stolen assets and estimated losses at $43–45 million before BingX confirmed the $52 million figure.","heading":"On-Chain Evidence","sources":[{"url":"https://cryptoslate.com/north-korea-linked-hack-costs-crypto-exchange-bingx-52-million-in-crypto-assets/","name":"","type":"other","credibility":3},{"url":"https://www.odaily.news/en/newsflash/420298","name":"","type":"other","credibility":3},{"url":"https://www.chaincatcher.com/en/article/2169265","name":"","type":"other","credibility":3},{"url":"https://www.panewslab.com/en/sqarticledetails/9w3i915j.html","name":"","type":"other","credibility":3},{"url":"https://news.bitcoin.com/bingx-hit-with-52-million-hack-lazarus-group-suspected/","name":"","type":"other","credibility":3}],"severity":"medium"},{"content":"BingX's regulatory footprint is inconsistent across jurisdictions and partially unverified by independent researchers. The exchange has confirmed registrations with AUSTRAC (Australia) and the FCIS (Lithuania). BingX has publicly claimed registration as a Money Services Business (MSB) with FinCEN (U.S. Treasury) through a subsidiary entity named BingX US Limited, and has separately claimed MSB registration with FINTRAC in Canada. However, independent research by Datawallet, which queries the FinCEN MSB registrant search directly, was unable to verify BingX's listing in the FinCEN database. US residents are explicitly blocked from using BingX's platform; third-party VPN guide pages confirm this restriction. The UK is similarly blocked following FCA regulatory requirements. BingX does not hold licenses from major Tier-1 financial regulators such as the FCA, SEC, or CFTC. The exchange operates in more than 160 countries but restricts access in over 20 jurisdictions due to sanctions and compliance obligations. No SEC, CFTC, or DOJ enforcement action against BingX has been identified as of May 2026.","heading":"Regulatory Status","sources":[{"url":"https://finance.yahoo.com/news/bingx-secures-compliance-license-us-150008425.html","name":"","type":"other","credibility":3},{"url":"https://www.datawallet.com/crypto/bingx-restricted-countries","name":"","type":"other","credibility":3},{"url":"https://www.prnewswire.com/in/news-releases/bingx-secures-compliance-licenses-in-the-united-states-and-canada-to-further-improve-the-global-security-system-862425432.html","name":"","type":"other","credibility":3},{"url":"https://www.coinperps.com/learn/bingx-restricted-countries","name":"","type":"other","credibility":3}],"severity":"medium"},{"content":"BingX operates a 'Shield Fund' described as a reserve to compensate users for losses arising from system errors, security incidents, or operational failures. The specific size of this fund has not been publicly disclosed with precision; unlike Binance's $1 billion SAFU fund or Bitget's $300 million protection fund, BingX has not published audited or independently verified Shield Fund balances. The exchange also maintains a separate insurance fund for futures trading. Following the September 2024 hack, CPO Vivien Lin publicly committed to full reimbursement of affected user funds from company capital; BingX stated it has sufficient reserves to cover all losses. Withdrawals were restored within approximately two days of the incident, and the exchange froze $10 million of stolen assets in cooperation with SlowMist and Chainalysis. BingX does not appear to publish regular Proof of Reserves (PoR) audits with third-party verification, which limits independent confirmation of solvency claims.","heading":"User Protections","sources":[{"url":"https://bingx.com/en/insurance-fund","name":"","type":"other","credibility":3},{"url":"https://blog.bingx.com/bingx-updates/20286/","name":"","type":"other","credibility":3},{"url":"https://www.halborn.com/blog/post/explained-the-bingx-hack-september-2024","name":"","type":"other","credibility":3},{"url":"https://cointelegraph.com/news/bing-x-confirms-resumption-withdrawal-services","name":"","type":"other","credibility":3}],"severity":"medium"},{"content":"BingX presents a mixed risk profile. The confirmed $52 million hot wallet breach in September 2024 — later linked by on-chain forensics to Lazarus Group, the same state-sponsored threat actor responsible for the $1.5 billion Bybit hack — demonstrates significant security deficiencies, specifically an over-reliance on centralized hot wallet key management rather than multi-signature or MPC wallet architecture. The initial public framing of the incident as 'wallet maintenance' rather than a breach, while ultimately explained as standard emergency protocol, contributed to short-lived but notable public trust concerns. Regulatory claims regarding US FinCEN and Canadian FINTRAC MSB registration have not been independently verified in public registrant databases, despite being used in marketing materials. US and UK users cannot access the platform at all. The Shield Fund's undisclosed size means compensation capacity cannot be independently assessed. Positively, BingX honored its stated commitment to reimburse affected users, restored services rapidly, and engaged reputable security firms (SlowMist, Chainalysis) in the post-incident investigation. The exchange's longevity since 2018 and stated user base of 10 million+ are noted but do not independently mitigate the above concerns. Users in jurisdictions where BingX is lawfully accessible should exercise elevated caution given the demonstrated vulnerability to sophisticated nation-state threat actors and the lack of transparent reserve disclosures.","heading":"Risk Assessment","sources":[{"url":"https://www.halborn.com/blog/post/explained-the-bingx-hack-september-2024","name":"","type":"other","credibility":3},{"url":"https://www.dlnews.com/articles/markets/bingx-dismiss-hack-cover-up-restore-deposit-withdrawal/","name":"","type":"other","credibility":3},{"url":"https://www.datawallet.com/crypto/bingx-restricted-countries","name":"","type":"other","credibility":3},{"url":"https://www.chaincatcher.com/en/article/2169265","name":"","type":"other","credibility":3}],"severity":"medium"}],"timeline":[{"date":"2018","event":"Exchange founded under the name Bingbon.","source":"","date_original":"2018-01-01"},{"date":"2021","event":"Bingbon rebrands to BingX.","source":"","date_original":"2021-01-01"},{"date":"2023-06","event":"BingX publicly announces MSB registrations in the US (FinCEN) and Canada (FINTRAC); claims not independently verified in public registrant databases.","source":"","date_original":"2023-06-01"},{"date":"2024-09-20","event":"Hot wallet breach detected at approximately 4:00 AM Singapore time; BingX suspends deposits and withdrawals, initially describing the event as 'temporary wallet maintenance.' Security firms Cyvers and PeckShield flag suspicious outflows of $26–43 million across seven blockchain networks.","source":""},{"date":"2024-09-20","event":"Cyvers attributes behavioral patterns of the attacker to tactics consistent with North Korea's Lazarus Group, though formal attribution is not confirmed at this stage.","source":""},{"date":"2024-09-21","event":"BingX acknowledges the security breach publicly. CPO Vivien Lin pledges full user reimbursement from company reserves. Estimated losses revised upward to approximately $52 million.","source":""},{"date":"2024-09-21","event":"BingX begins working with SlowMist and Chainalysis on forensic investigation. $10 million in stolen assets frozen.","source":""},{"date":"2024-09-22","event":"BingX restores deposits and withdrawals for USDT, USDC, BTC, ETH, TRX, and SOL. Accusations of a cover-up dismissed by CPO Vivien Lin via public AMA.","source":""},{"date":"2025-02-22","event":"Blockchain investigator ZachXBT publishes on-chain analysis demonstrating that an address used in the BingX hack is directly connected to the address cluster behind the Phemex hack and the $1.5 billion Bybit hack, linking all three incidents to Lazarus Group.","source":""},{"date":"2025-02-23","event":"ZachXBT further links Poloniex to the same Lazarus Group cluster, identifying four major exchange hacks connected to a single threat actor.","source":""}],"sources_used":[{"url":"https://bingx.com/en/about","name":"","type":"other","archive_url":"http://web.archive.org/web/20260812031604/https://bingx.com/en/about","credibility":3,"archive_timestamp":"2026-08-12T03:16:04+00:00"},{"url":"https://www.crunchbase.com/organization/bingx","name":"","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://bitcoinwiki.org/wiki/bingx","name":"","type":"other","archive_url":"http://web.archive.org/web/20260612150426/https://bitcoinwiki.org/wiki/bingx","credibility":3,"archive_timestamp":"2026-06-12T15:04:26+00:00"},{"url":"https://www.dlnews.com/articles/markets/bingx-dismiss-hack-cover-up-restore-deposit-withdrawal/","name":"","type":"other","archive_url":"http://web.archive.org/web/20260625163044/https://www.dlnews.com/articles/markets/bingx-dismiss-hack-cover-up-restore-deposit-withdrawal/","credibility":3,"archive_timestamp":"2026-06-25T16:30:44+00:00"},{"url":"https://www.coindesk.com/tech/2024/09/20/crypto-exchange-bingx-hacked-onchain-data-shows-over-43m-drained","name":"","type":"other","archive_url":null,"credibility":3,"archive_timestamp":null},{"url":"https://www.halborn.com/blog/post/explained-the-bingx-hack-september-2024","name":"","type":"other","archive_url":"http://web.archive.org/web/20260415072013/https://www.halborn.com/blog/post/explained-the-bingx-hack-september-2024","credibility":3,"archive_timestamp":"2026-04-15T07:20:13+00:00"},{"url":"https://blog.bingx.com/bingx-updates/ama-recap-with-bingx-cpo-vivien-lin-addressing-the-recent-hot-wallet-incident/","name":"","type":"other","archive_url":"https://web.archive.org/web/20260830040338/https://bingx.com/en/blog/bingx-updates/ama-recap-with-bingx-cpo-vivien-lin-addressing-the-recent-hot-wallet-incident","credibility":3,"archive_timestamp":"2026-08-30T04:03:38+00:00"},{"url":"https://cryptoslate.com/north-korea-linked-hack-costs-crypto-exchange-bingx-52-million-in-crypto-assets/","name":"","type":"other","archive_url":"http://web.archive.org/web/20260315232128/https://cryptoslate.com/north-korea-linked-hack-costs-crypto-exchange-bingx-52-million-in-crypto-assets/","credibility":3,"archive_timestamp":"2026-03-15T23:21:28+00:00"},{"url":"https://www.odaily.news/en/newsflash/420298","name":"","type":"other","archive_url":"https://web.archive.org/web/20260829152527/https://www.odaily.news/en/newsflash/420298","credibility":3,"archive_timestamp":"2026-08-29T15:25:27+00:00"},{"url":"https://www.chaincatcher.com/en/article/2169265","name":"","type":"other","archive_url":"http://web.archive.org/web/20260410194054/https://www.chaincatcher.com/en/article/2169265","credibility":3,"archive_timestamp":"2026-04-10T19:40:54+00:00"},{"url":"https://www.panewslab.com/en/sqarticledetails/9w3i915j.html","name":"","type":"other","archive_url":null,"credibility":3,"archive_timestamp":null},{"url":"https://news.bitcoin.com/bingx-hit-with-52-million-hack-lazarus-group-suspected/","name":"","type":"other","archive_url":"http://web.archive.org/web/20260412121336/https://news.bitcoin.com/bingx-hit-with-52-million-hack-lazarus-group-suspected/","credibility":3,"archive_timestamp":"2026-04-12T12:13:36+00:00"},{"url":"https://finance.yahoo.com/news/bingx-secures-compliance-license-us-150008425.html","name":"","type":"other","archive_url":null,"credibility":3,"archive_timestamp":null},{"url":"https://www.datawallet.com/crypto/bingx-restricted-countries","name":"","type":"other","archive_url":"http://web.archive.org/web/20251113115119/https://www.datawallet.com/crypto/bingx-restricted-countries","credibility":3,"archive_timestamp":"2025-11-13T11:51:19+00:00"},{"url":"https://www.prnewswire.com/in/news-releases/bingx-secures-compliance-licenses-in-the-united-states-and-canada-to-further-improve-the-global-security-system-862425432.html","name":"","type":"other","archive_url":"http://web.archive.org/web/20251114095732/https://www.prnewswire.com/in/news-releases/bingx-secures-compliance-licenses-in-the-united-states-and-canada-to-further-improve-the-global-security-system-862425432.html","credibility":3,"archive_timestamp":"2025-11-14T09:57:32+00:00"},{"url":"https://www.coinperps.com/learn/bingx-restricted-countries","name":"","type":"other","archive_url":"http://web.archive.org/web/20260418174629/https://www.coinperps.com/learn/bingx-restricted-countries","credibility":3,"archive_timestamp":"2026-04-18T17:46:29+00:00"},{"url":"https://bingx.com/en/insurance-fund","name":"","type":"other","archive_url":"http://web.archive.org/web/20260712233028/https://bingx.com/en/insurance-fund","credibility":3,"archive_timestamp":"2026-07-12T23:30:28+00:00"},{"url":"https://blog.bingx.com/bingx-updates/20286/","name":"","type":"other","archive_url":"https://web.archive.org/web/20260829233124/https://bingx.com/en/blog/bingx-updates/20286","credibility":3,"archive_timestamp":"2026-08-29T23:31:24+00:00"},{"url":"https://cointelegraph.com/news/bing-x-confirms-resumption-withdrawal-services","name":"","type":"other","archive_url":"http://web.archive.org/web/20260209214344/https://cointelegraph.com/news/bing-x-confirms-resumption-withdrawal-services","credibility":3,"archive_timestamp":"2026-02-09T21:43:44+00:00"}],"source_tags":["defillama"],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-sonnet-4-6","created_at":"2026-05-04T02:54:28.980259+00:00","updated_at":"2026-08-30T05:14:06.022186+00:00"}}