{"investigation":{"slug":"bitopro","entity_name":"BitoPro","trust_score":38,"severity_base":null,"score_modifier":0,"confidence":1,"status":"published","content_type":"investigation","summary":"BitoPro is a Taiwanese centralized cryptocurrency exchange operated by BitoGroup, serving over 800,000 users with TWD (New Taiwan Dollar) fiat on/off-ramps. On May 8, 2025, the exchange suffered an approximately $11.5 million hot wallet theft attributed to North Korea's Lazarus Group via a social-engineering and AWS-token-hijacking attack. The exchange did not publicly disclose the breach for approximately 25 days, only confirming the incident after on-chain investigator ZachXBT flagged suspicious outflows on June 2, 2025.","sections":[{"content":"On May 8, 2025, BitoPro's hot wallets across Ethereum, Tron, Solana, and Polygon experienced approximately $11.5 million in unauthorized outflows. The breach occurred during a routine hot wallet system upgrade and asset reallocation operation. According to BitoPro's subsequent investigation, attackers deployed malware on the device of a cloud operations employee through social engineering, then used hijacked AWS session tokens to bypass multi-factor authentication and gain control of BitoPro's cloud infrastructure. A command-and-control (C2) server was used to send malicious instructions to an implant on the hot wallet host. Injected scripts were designed to simulate legitimate wallet operations to mask the theft. BitoPro stated its internal investigation found no evidence of insider involvement.","heading":"Security Incident: $11.5M Hot Wallet Hack (May 2025)","sources":[],"severity":"medium"},{"content":"BitoPro publicly attributed the May 8 attack to Lazarus Group, the North Korean state-sponsored threat actor linked to numerous high-profile cryptocurrency and financial institution heists. BitoPro stated the attack patterns and methodology bear resemblance to patterns observed in multiple past incidents attributed to the group, including illicit transfers from SWIFT banking systems and prior crypto exchange compromises. The attribution is based on BitoPro's internal investigation, supplemented by an external cybersecurity investigation completed on June 11, 2025. Independent security researchers and media outlets including BleepingComputer and Bitdefender reported the attribution claim. Independent government or law enforcement confirmation of the Lazarus attribution had not been publicly issued as of the time of this investigation; the attribution therefore remains alleged pending official verification.","heading":"Lazarus Group Attribution","sources":[],"severity":"medium"},{"content":"The breach was not publicly disclosed by BitoPro for approximately 25 days after it occurred. The exchange's only public communication during this period was a vague maintenance announcement that made no mention of a security incident. On June 2, 2025, pseudonymous on-chain investigator ZachXBT posted findings on Telegram identifying suspicious outflows of approximately $11.5 million from multiple BitoPro hot wallets across Tron, Ethereum, Solana, and Polygon networks, stating the exchange had 'likely been exploited.' ZachXBT documented the laundering trail: stolen funds were sold on decentralized exchanges, then routed through Tornado Cash, bridged to Bitcoin via ThorChain, and deposited into Wasabi Wallet — privacy tools commonly used to obscure transaction origin. BitoPro confirmed the breach approximately three hours after ZachXBT's public post. The 25-day disclosure gap drew significant criticism from the crypto community and media, with outlets including Protos noting this behavior violates industry transparency norms and may implicate Taiwanese regulatory expectations for licensed crypto operators.","heading":"ZachXBT On-Chain Investigation and Disclosure Timeline","sources":[],"severity":"medium"},{"content":"According to ZachXBT's on-chain analysis and BitoPro's subsequent confirmation, stolen assets were laundered through a multi-step obfuscation chain: initial conversion via decentralized exchanges, followed by routing through Tornado Cash (an Ethereum-based mixer), bridging to Bitcoin via ThorChain, and final deposit into Wasabi Wallet (a Bitcoin CoinJoin implementation). This combination of mixing and cross-chain bridging substantially reduces the tractability of stolen funds. BitoPro stated it replenished affected wallets using internal reserves, and that all user deposits, withdrawals, and trading continued without interruption. The company emphasized that user assets were not at risk. However, recovery of the stolen funds themselves is widely considered unlikely given the obfuscation methods employed. CoinGecko data cited by Fortune indicated a 21% drop in BitoPro trading volume following the public disclosure.","heading":"Stolen Funds: Laundering Path and Recovery Prospects","sources":[],"severity":"medium"},{"content":"BitoPro is operated by BitoGroup (formerly BitoEX), a Taiwanese blockchain company founded in 2014. The exchange launched its trading platform in 2018 and has grown to serve over 800,000 registered users. BitoPro is one of Taiwan's largest cryptocurrency exchanges by market share, and its primary differentiator is direct fiat trading against the New Taiwan Dollar (TWD). The platform also issues a native BITO token that provides fee discounts. BitoPro has obtained ISO 27001 certification for information security management and has completed the Taiwan Financial Supervisory Commission's AML compliance declaration. The source tag 'twt-fiat' in the original flagging context refers to BitoPro's TWD fiat on-ramp functionality, which is a key feature of the exchange for Taiwanese users.","heading":"Exchange Background and TWD/TWT Context","sources":[],"severity":"medium"},{"content":"BitoPro is subject to oversight by Taiwan's Financial Supervisory Commission (FSC) and has represented compliance with local AML requirements. The 25-day delay in disclosing a material security breach may be subject to regulatory scrutiny under Taiwan's virtual asset service provider (VASP) framework. As of the time of this investigation, no formal regulatory action or enforcement proceeding against BitoPro related to the May 2025 incident has been publicly reported. The exchange has stated it notified relevant authorities after the incident was identified.","heading":"Regulatory and Compliance Implications","sources":[],"severity":"medium"}],"timeline":[{"date":"2018","event":"BitoPro exchange launched by BitoGroup (BitoEX team), providing TWD fiat crypto trading in Taiwan.","source":"","source_url":"https://tradingfinder.com/exchanges/bitopro/","date_original":"2018-01-01"},{"date":"2025-05-08","event":"Lazarus Group (alleged) exploits BitoPro hot wallets during a routine system upgrade, stealing approximately $11.5 million across Ethereum, Tron, Solana, and Polygon via malware, AWS session token hijacking, and C2-directed withdrawals.","source":"","source_url":"https://www.bleepingcomputer.com/news/security/bitopro-exchange-links-lazarus-hackers-to-11-million-crypto-heist/"},{"date":"2025-06-02","event":"ZachXBT publicly flags approximately $11.5 million in suspicious hot wallet outflows from BitoPro on Telegram, stating the exchange was 'likely exploited.' ZachXBT documents the laundering trail through Tornado Cash, ThorChain, and Wasabi Wallet.","source":"","source_url":"https://www.theblock.co/post/356522/zachxbt-flags-suspicious-11-5m-outflows-from-bitopro-exchanges-hot-wallets-says-it-was-likely-exploited"},{"date":"2025-06-02","event":"BitoPro confirms the security breach approximately three hours after ZachXBT's public post, stating an 'old hot wallet' was compromised during a system upgrade. The exchange states user funds are unaffected and have been replenished from internal reserves.","source":"","source_url":"https://fortune.com/crypto/2025/06/03/taiwanese-crypto-exchange-bitopro-confirms-hack/"},{"date":"2025-06-03","event":"Major outlets including Fortune, CoinDesk, and CryptoNews report on the confirmed BitoPro hack. CoinGecko data shows a 21% drop in exchange trading volume following public disclosure.","source":"","source_url":"https://www.coindesk.com/tech/2025/06/02/taiwanese-crypto-exchange-bitopro-likely-hacked-for-usd11m-in-may-zachxbt-says"},{"date":"2025-06-11","event":"BitoPro announces completion of external cybersecurity investigation, attributing the attack to Lazarus Group based on TTPs consistent with prior Lazarus operations including SWIFT-system exploits and previous exchange heists.","source":"","source_url":"https://www.bleepingcomputer.com/news/security/bitopro-exchange-links-lazarus-hackers-to-11-million-crypto-heist/"}],"sources_used":[],"source_tags":["zachxbt"],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-sonnet","created_at":"2026-05-04T16:05:05.608748+00:00","updated_at":"2026-08-29T01:35:51.264+00:00"}}