{"investigation":{"slug":"bitrue","entity_name":"Bitrue","trust_score":18,"severity_base":null,"score_modifier":0,"confidence":1,"status":"published","content_type":"investigation","summary":"Bitrue is a Singapore-incorporated centralized cryptocurrency exchange founded in 2018 that suffered a confirmed $23 million hot wallet exploit in April 2023, with stolen funds subsequently laundered through Tornado Cash as recently as June 2025. The exchange holds no license from Singapore's Monetary Authority (MAS) and relies on a VASP registration in Lithuania — a lower-tier regulatory framework — while accumulating a persistent record of user complaints alleging unjustified account freezes and asset seizures.","sections":[{"content":"Bitrue was founded in July 2018 in Singapore, initially supporting five cryptocurrencies with a stated focus on XRP-centric trading. The company's corporate entity is registered in Singapore (REALB SINGAPORE PTE. LTD., UEN 201818989M). Founders include Curis Wang (who served as CEO from 2018 to at least 2021), Tushar Lohani, Rakesh Handa, and Himanshu Lohani. The exchange has grown to list over 700 cryptocurrencies, offering spot trading, futures, copy trading, staking (marketed as 'Power Piggy'), and OTC desks. BTR is the platform's native token, used for fee discounts. Bitrue restricts access to users in China, US-sanctioned jurisdictions, Texas, and New York.","heading":"Background","sources":[{"url":"https://iq.wiki/wiki/bitrue","name":"","type":"other","credibility":3},{"url":"https://www.cbinsights.com/company/bitrue/people","name":"","type":"other","credibility":3},{"url":"https://en.everybodywiki.com/Bitrue_Inc","name":"","type":"other","credibility":3}],"severity":"medium"},{"content":"On April 14, 2023, at 07:18 UTC, an unidentified attacker exploited a vulnerability in one of Bitrue's hot wallets, draining approximately $23 million in digital assets. Tokens stolen included ETH, QNT, GALA, SHIB, HOT, and MATIC. Bitrue acknowledged the incident on the same day, suspended all withdrawals, and stated the compromised wallet represented less than 5% of total reserves. Withdrawals were restored on April 18, 2023. Bitrue committed to compensating all affected users in full, though specific technical details of the exploit were not disclosed publicly. Following the breach, the attacker converted the majority of stolen assets into ETH directly on-chain. The attack wallet remained largely dormant for approximately eleven months before becoming active again in March 2024, when the attacker sold 4,207 ETH for roughly $16.3 million in DAI. In June 2025, blockchain analyst @EmberCN reported additional activity: the attacker converted 8.3 million DAI into approximately 3,000 ETH and funneled an estimated 4,600 ETH (around $12.65 million) through Tornado Cash, the U.S. Treasury-sanctioned crypto mixer, in a structured multi-stage laundering operation. By mid-2025, the total stolen proceeds had been converted to approximately 12,079 ETH valued at roughly $32.4 million — a $9.4 million gain over the original theft, attributed to ETH price appreciation. As of the latest reporting, the wallet still contained approximately 8.04 million DAI and 3,510 ETH.","heading":"The Hack","sources":[{"url":"https://www.coindesk.com/business/2023/04/14/crypto-exchange-bitrue-drained-of-23m-in-hack-of-ether-shiba-inu-other-tokens","name":"","type":"other","credibility":3},{"url":"https://cointelegraph.com/news/crypto-exchange-bitrue-suffers-23m-hack-due-to-hot-wallet-eploit","name":"","type":"other","credibility":3},{"url":"https://coinedition.com/bitrue-hack-wallet-launders-funds-tornado-cash/","name":"","type":"other","credibility":3},{"url":"https://coinedition.com/bitrue-hacker-tornado-cash-laundering-crypto-security-update/","name":"","type":"other","credibility":3},{"url":"https://www.tronweekly.com/bitrue-hacker-launders-23m-via-tornado-cash-nets-9-3m-profit-in-eth/","name":"","type":"other","credibility":3}],"severity":"medium"},{"content":"Bitrue does not hold a license or registration from the Monetary Authority of Singapore (MAS), Singapore's primary financial regulator. According to Bitrue's own published regulatory statement, the exchange has no operations or offices in Singapore, does not offer products to Singapore residents, and does not conduct Digital Payment Token (DPT) activities in Singapore — despite being incorporated there. In October 2024, Bitrue announced that its Lithuanian subsidiary, Bitrue Lithuania UAB, received Virtual Asset Service Provider (VASP) registration from Lithuania's Financial Crime Investigation Service (Finansinių nusikaltimų tyrimo tarnyba, FNTT), registration number 306725033. This registration permits digital asset exchange and custody wallet services within that jurisdiction. Lithuania's VASP regime, however, was superseded as of January 1, 2026, requiring entities to obtain a full Crypto-Asset Service Provider (CASP) license from the Bank of Lithuania under the EU's MiCA framework. Bitrue has stated intentions to pursue a MiCA CASP license but no confirmation of approval has been publicly reported as of the date of this investigation. No enforcement actions by the U.S. SEC, CFTC, DOJ, or equivalent Tier 1 regulators against Bitrue have been identified.","heading":"Regulatory Status","sources":[{"url":"https://www.bitrue.com/blog/Bitrue-Secures-VASP-Registration-in-Lithuania","name":"","type":"other","credibility":3},{"url":"https://blockchainreporter.net/bitrue-gets-lithuanian-vasp-license-expanding-eu-digital-services/","name":"","type":"other","credibility":3},{"url":"https://coinjournal.net/news/bitrue-gets-virtual-asset-service-provider-approval-in-lithuania/","name":"","type":"other","credibility":3},{"url":"https://cexfinder.com/gemini-singapore-bitrue-lithuania-licenses/","name":"","type":"other","credibility":3}],"severity":"medium"},{"content":"Multiple user protection concerns have been documented through community reports and third-party platforms. In February 2021, blockchain analytics firm XRP Forensics publicly called out Bitrue after receiving complaints from users whose accounts had been frozen without clear justification. XRP Forensics demanded that Bitrue either provide evidence supporting the account freezes or allow users to withdraw their funds. Bitrue's public response cited a ban on arbitrage trading and attributed some cases to email access issues, referring affected users back to their email providers. Bitrue stated only 'a small number of users' were affected, and no independent verification of account totals was available. Incidents of alleged unjustified account freezes and asset seizures were reported again in late 2023, including a documented case on GitHub in which a user alleged that Bitrue seized $12,000 in assets following automated trading activity, with a retroactive finding that the user had participated in a 'trading attack' through arbitrage scripts. A petition filed on iPetitions alleged systematic blocking of user funds without adequate reason or warning, describing the activity as ongoing. Customer service responsiveness has been a consistent point of complaint, with users reporting generic or automated replies and lengthy resolution timelines. Bitrue stated that all users affected by the April 2023 hack were compensated in full, though no independent audit of that compensation has been publicly produced.","heading":"User Protections","sources":[{"url":"https://beincrypto.com/xrp-forensics-calls-out-bitrue-for-shuttering-users/","name":"","type":"other","credibility":3},{"url":"https://github.com/ccxt/ccxt/issues/20613","name":"","type":"other","credibility":3},{"url":"https://www.ipetitions.com/petition/crypto-exchange-bitrue-is-stealing-money-from-its","name":"","type":"other","credibility":3},{"url":"https://www.trustpilot.com/review/www.bitrue.com","name":"","type":"other","credibility":3}],"severity":"medium"},{"content":"Bitrue presents several compounding risk factors. First, the confirmed $23 million hot wallet exploit of April 2023 establishes a material security failure. The fact that stolen funds remained largely unrecovered and were actively laundered through Tornado Cash through at least June 2025 — more than two years after the breach — indicates no successful law enforcement recovery. Second, the exchange operates without a license from Singapore's MAS despite its Singapore incorporation, and its sole active regulatory credential (Lithuania VASP) represents a lower-tier compliance regime that was structurally superseded under MiCA as of January 2026. Third, the pattern of alleged account freezes and asset seizures — spanning 2021 through late 2023 — raises questions about fund accessibility and consistent application of platform rules. Fourth, Bitrue's lack of a published proof-of-reserves audit from an independent third party limits user ability to verify solvency claims. Against these factors, Bitrue has operated continuously since 2018, publicly acknowledged and disclosed the 2023 hack in a timely manner, stated that affected users were compensated, and obtained a VASP registration in an EU-adjacent jurisdiction. The exchange is not the subject of any known Tier 1 regulatory enforcement action as of this investigation.","heading":"Risk Assessment","sources":[{"url":"https://www.coindesk.com/business/2023/04/14/crypto-exchange-bitrue-drained-of-23m-in-hack-of-ether-shiba-inu-other-tokens","name":"","type":"other","credibility":3},{"url":"https://brokerchooser.com/safety/bitrue-broker-safe-or-scam","name":"","type":"other","credibility":3},{"url":"https://tradersunion.com/scam-or-safe/bitrue-review/","name":"","type":"other","credibility":3}],"severity":"medium"}],"timeline":[{"date":"2018-07","event":"Bitrue founded in Singapore by Curis Wang and co-founders, initially supporting five cryptocurrencies with XRP focus.","source":"","date_original":"2018-07-01"},{"date":"2021-02-12","event":"XRP Forensics publicly calls out Bitrue for freezing user accounts without clear justification; Bitrue cites arbitrage trading ban.","source":""},{"date":"2023-04-14","event":"Attacker exploits a Bitrue hot wallet at 07:18 UTC, draining approximately $23 million in ETH, QNT, GALA, SHIB, HOT, and MATIC. All withdrawals suspended.","source":""},{"date":"2023-04-18","event":"Bitrue restores withdrawal services after security review. Exchange states all affected users will be compensated in full.","source":""},{"date":"2023-12","event":"User alleges Bitrue seized $12,000 in assets citing a 'trading attack' involving automated scripts; case documented on GitHub.","source":"","date_original":"2023-12-01"},{"date":"2024-03","event":"Previously dormant Bitrue hack wallet reactivates; attacker sells 4,207 ETH, generating approximately $16.3 million in DAI.","source":"","date_original":"2024-03-01"},{"date":"2024-10-28","event":"Bitrue Lithuania UAB receives VASP registration from Lithuania's FNTT (registration 306725033), the exchange's first formal regulatory credential.","source":""},{"date":"2025-06","event":"On-chain analyst @EmberCN reports Bitrue hack wallet laundering approximately $12.65 million (4,600 ETH) through Tornado Cash in structured multi-stage operations. Total stolen proceeds estimated at $32.4 million after ETH appreciation.","source":"","date_original":"2025-06-01"}],"sources_used":[{"url":"https://iq.wiki/wiki/bitrue","name":"","type":"other","archive_url":"http://web.archive.org/web/20260217124527/https://iq.wiki/wiki/bitrue","credibility":3,"archive_timestamp":"2026-02-17T12:45:27+00:00"},{"url":"https://www.cbinsights.com/company/bitrue/people","name":"","type":"other","archive_url":"https://web.archive.org/web/20260829144920/https://www.cbinsights.com/company/bitrue/people","credibility":3,"archive_timestamp":"2026-08-29T14:49:20+00:00"},{"url":"https://en.everybodywiki.com/Bitrue_Inc","name":"","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://www.coindesk.com/business/2023/04/14/crypto-exchange-bitrue-drained-of-23m-in-hack-of-ether-shiba-inu-other-tokens","name":"","type":"other","archive_url":null,"credibility":3,"archive_timestamp":null},{"url":"https://cointelegraph.com/news/crypto-exchange-bitrue-suffers-23m-hack-due-to-hot-wallet-eploit","name":"","type":"other","archive_url":"http://web.archive.org/web/20260712030349/https://cointelegraph.com/news/crypto-exchange-bitrue-suffers-23m-hack-due-to-hot-wallet-eploit/","credibility":3,"archive_timestamp":"2026-07-12T03:03:49+00:00"},{"url":"https://coinedition.com/bitrue-hack-wallet-launders-funds-tornado-cash/","name":"","type":"other","archive_url":"http://web.archive.org/web/20260713042407/https://coinedition.com/bitrue-hack-wallet-launders-funds-tornado-cash/","credibility":3,"archive_timestamp":"2026-07-13T04:24:07+00:00"},{"url":"https://coinedition.com/bitrue-hacker-tornado-cash-laundering-crypto-security-update/","name":"","type":"other","archive_url":"http://web.archive.org/web/20260819194945/https://coinedition.com/bitrue-hacker-tornado-cash-laundering-crypto-security-update/","credibility":3,"archive_timestamp":"2026-08-19T19:49:45+00:00"},{"url":"https://www.tronweekly.com/bitrue-hacker-launders-23m-via-tornado-cash-nets-9-3m-profit-in-eth/","name":"","type":"other","archive_url":"http://web.archive.org/web/20260124003141/https://www.tronweekly.com/bitrue-hacker-launders-23m-via-tornado-cash-nets-9-3m-profit-in-eth/","credibility":3,"archive_timestamp":"2026-01-24T00:31:41+00:00"},{"url":"https://www.bitrue.com/blog/Bitrue-Secures-VASP-Registration-in-Lithuania","name":"","type":"other","archive_url":"https://web.archive.org/web/20260830045052/https://www.bitrue.com/blog/Bitrue-Secures-VASP-Registration-in-Lithuania","credibility":3,"archive_timestamp":"2026-08-30T04:50:52+00:00"},{"url":"https://blockchainreporter.net/bitrue-gets-lithuanian-vasp-license-expanding-eu-digital-services/","name":"","type":"other","archive_url":null,"credibility":3,"archive_timestamp":null},{"url":"https://coinjournal.net/news/bitrue-gets-virtual-asset-service-provider-approval-in-lithuania/","name":"","type":"other","archive_url":"https://web.archive.org/web/20260829125404/https://coinjournal.net/news/vantard-excites-investors-as-trump-project-eyes-lift/?dynamic","credibility":3,"archive_timestamp":"2026-08-29T12:54:04+00:00"},{"url":"https://cexfinder.com/gemini-singapore-bitrue-lithuania-licenses/","name":"","type":"other","archive_url":"https://web.archive.org/web/20260829125037/https://cexfinder.com/gemini-singapore-bitrue-lithuania-licenses/","credibility":3,"archive_timestamp":"2026-08-29T12:50:37+00:00"},{"url":"https://beincrypto.com/xrp-forensics-calls-out-bitrue-for-shuttering-users/","name":"","type":"other","archive_url":null,"credibility":3,"archive_timestamp":null},{"url":"https://github.com/ccxt/ccxt/issues/20613","name":"","type":"other","archive_url":"https://web.archive.org/web/20260830000945/https://github.com/ccxt/ccxt/issues/20613","credibility":3,"archive_timestamp":"2026-08-30T00:09:45+00:00"},{"url":"https://www.ipetitions.com/petition/crypto-exchange-bitrue-is-stealing-money-from-its","name":"","type":"other","archive_url":"http://web.archive.org/web/20260419172947/https://www.ipetitions.com/petition/crypto-exchange-bitrue-is-stealing-money-from-its","credibility":3,"archive_timestamp":"2026-04-19T17:29:47+00:00"},{"url":"https://www.trustpilot.com/review/www.bitrue.com","name":"","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://brokerchooser.com/safety/bitrue-broker-safe-or-scam","name":"","type":"other","archive_url":null,"credibility":3,"archive_timestamp":null},{"url":"https://tradersunion.com/scam-or-safe/bitrue-review/","name":"","type":"other","archive_url":null,"credibility":3,"archive_timestamp":null}],"source_tags":["defillama"],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-sonnet-4-6","created_at":"2026-05-04T02:54:42.619229+00:00","updated_at":"2026-08-30T05:14:11.313413+00:00"}}