{"investigation":{"slug":"heco-bridge","entity_name":"Heco Bridge","trust_score":5,"severity_base":null,"score_modifier":0,"confidence":1,"status":"published","content_type":"investigation","summary":"Heco Bridge was the official cross-chain bridge connecting the HECO Chain (HTX Eco Chain) to Ethereum, operated by HTX (formerly Huobi) and associated with Justin Sun. On November 22, 2023, the bridge operator's private key was compromised, resulting in the theft of approximately $86.6 million in crypto assets; combined with a simultaneous HTX hot wallet breach, total losses reached approximately $99 million. Blockchain analytics firm Elliptic attributed the attack to North Korea's Lazarus Group, which subsequently laundered over $100 million of the proceeds through Tornado Cash. The HECO Network was permanently shut down on January 15, 2025.","sections":[{"content":"Huobi Eco Chain (HECO) was launched on December 21, 2020 by Huobi Group (later rebranded as HTX) as an EVM-compatible Layer 1 blockchain built on a Hybrid Proof of Stake (HPoS) consensus mechanism combining Proof of Authority and Proof of Stake. At its peak in 2021, the network's total value locked (TVL) reached approximately $3 billion. Huobi DeFi Labs simultaneously announced a $200 million ecosystem fund to support projects building on the chain. The Heco Bridge was the native cross-chain bridge enabling users to transfer assets — including BTC, ETH, and stablecoins — between HECO Chain and Ethereum by locking tokens on the source chain and minting equivalent tokens on the destination chain. In 2022, Tron founder Justin Sun became a prominent backer and advisor to HTX, and his influence over the exchange and its associated infrastructure became widely reported. By late 2023, amid competitive pressure from other L1 blockchains and a prolonged market downturn, HECO's activity had declined materially. The bridge's centralized operator model — in which a single privileged 'operator' wallet controlled withdrawal permissions — represented the critical single point of failure that the November 2023 exploit would target.","heading":"Background","sources":[{"url":"https://www.prnewswire.com/news-releases/huobi-announces-early-access-to-huobi-eco-chain-an-ethereum-compatible-public-chain-for-blockchain-developers-301190736.html","name":"","type":"other","credibility":3},{"url":"https://pontem.network/posts/a-deep-dive-into-the-heco-chain","name":"","type":"other","credibility":3},{"url":"https://coinmarketcap.com/academy/article/52cb9dfd-1370-47cc-a30e-dc3a67bbcd9a","name":"","type":"other","credibility":3}],"severity":"medium"},{"content":"On November 22, 2023, at approximately 10:00 UTC, the Heco Bridge operator wallet (0x3d655889d197125fb90dcb72e4a287a8410ed1b9) began executing unauthorized withdrawToken calls on the bridge contract (0xa929022c9107643515f5c777ce9a910f0d1e490c), transferring assets directly to an attacker-controlled accumulation address (0xfc146d1caf6ba1d1ce6dcb5b35dcbf895f50b0c4). Because the withdrawToken function was accessible only to the privileged operator role, security researchers at CertiK, Hacken, and ImmuneBytes concluded the most probable attack vector was a private key compromise of the operator account rather than a smart contract vulnerability. The stolen assets from the bridge totaled approximately $86.6 million and included: 42 million USDT, approximately 10,000 ETH (valued at roughly $19 million), 489 HBTC (roughly $18.8 million), 347 million SHIB (roughly $2.8 million), 173,000 UNI, 619,000 USDC, 42,000 LINK, and 347,000 TUSD. Stolen tokens were immediately swapped for ETH on decentralized exchanges to maximize fungibility. A significant portion — approximately $63 million — was concentrated in holding address 0xe47e6dA16Bb83EB0FD26b3F29b15CE8Fab089B9e. Simultaneously, HTX hot wallets (0xb9f775179bcc7fcf4534700a48f09c590e390ead and 0x9281035df6f00557c0285d7df21d323c2e2f99ad) were separately drained of approximately $12.5 million in ETH, USDT, USDC, and LINK, bringing the combined loss to roughly $99 million. Justin Sun confirmed the attack within hours, offering the attacker a 5% white-hat bounty for the return of funds — an offer that was not accepted.","heading":"The Exploit","sources":[{"url":"https://rekt.news/heco-htx-rekt","name":"","type":"other","credibility":3},{"url":"https://hacken.io/insights/heco-bridge-hack-explained/","name":"","type":"other","credibility":3},{"url":"https://immunebytes.com/blog/heco-bridge-exploited-for-over-87m-in-a-suspected-private-key-leak/","name":"","type":"other","credibility":3},{"url":"https://www.certik.com/resources/blog/heco-bridge-exploit","name":"","type":"other","credibility":3},{"url":"https://blockworks.co/news/htx-hack-ethereum-crypto-assets","name":"","type":"other","credibility":3}],"severity":"medium"},{"content":"On-chain analysis by multiple security firms identified the following key addresses involved in the attack. The compromised bridge operator wallet (0x3d655889d197125fb90dcb72e4a287a8410ed1b9) executed the privileged withdrawToken function to route funds to the primary attacker address (0xfc146d1caf6ba1d1ce6dcb5b35dcbf895f50b0c4). A large share of the stolen funds — approximately $63 million — was consolidated at 0xe47e6dA16Bb83EB0FD26b3F29b15CE8Fab089B9e. Additional attacker-linked addresses identified by Hacken include 0x6a40dfe3008bc3f99907e6dff4d041f933493411, 0x640e567a5041c7108033dadb0b47a3f7aedd661b, 0x945647f6225a44e35a0ea50f9fe2b4321794aa29, 0x153d99836e197f92a8385ba80afbb57b69de2cc1, and 0x7abd8dda6cca1785af2f812b171b98d6924ff5d2. On the HTX side, two separate attacker wallets (0x5a22f867dfcb4f32d25a5fa365b9d9d78d5515dc for ETH; 0x121a0ff24027fffcdd0ae008da82f2789c7945cc for other assets) received proceeds from the compromised hot wallets. After the initial theft, stolen tokens were swapped to ETH on decentralized exchanges — a pattern consistent with Lazarus Group laundering operations documented by Elliptic and the FBI. The stolen funds then lay dormant for approximately four months before movement resumed in March 2024.","heading":"On-Chain Evidence","sources":[{"url":"https://hacken.io/insights/heco-bridge-hack-explained/","name":"","type":"other","credibility":3},{"url":"https://rekt.news/heco-htx-rekt","name":"","type":"other","credibility":3},{"url":"https://olympixai.medium.com/heco-bridge-hack-analysis-64cffda76684","name":"","type":"other","credibility":3}],"severity":"medium"},{"content":"The Heco Bridge attack did not occur in isolation. Two weeks prior, on November 10, 2023, Poloniex — a crypto exchange also linked to Justin Sun — suffered a $120 million exploit through a similar suspected private key compromise, also attributed by analysts to the Lazarus Group. Security researchers noted that three Justin Sun-affiliated platforms (HTX, Heco Bridge, and Poloniex) lost over $200 million in a span of approximately two months. CoinTelegraph reported that Justin Sun-related crypto platforms had been hacked four times in two months by late November 2023, reflecting what analysts described as a systemic operational security failure across Sun-affiliated entities. CertiK noted that the Heco Bridge incident contributed to a 2023 total of over $800 million lost to private key compromises, representing 56% of all funds lost to crypto exploits that year. The REKT News post-mortem noted that PeckShield had previously flagged that vulnerabilities from prior hacks may have been reused. Justin Sun confirmed the attack via social media within hours and pledged that HTX would fully reimburse users for hot wallet losses; he did not make an equivalent blanket pledge for the bridge losses and instead offered the attacker a 5% bounty. The bridge and associated HECO Chain services were suspended pending investigation.","heading":"HTX Connection and Broader Pattern","sources":[{"url":"https://cointelegraph.com/news/justin-sun-platforms-hacked-4-times","name":"","type":"other","credibility":3},{"url":"https://www.coindesk.com/tech/2023/11/22/justin-sun-confirms-htx-heco-chain-exploited-after-100m-in-suspicious-transfers","name":"","type":"other","credibility":3},{"url":"https://coinpaper.com/2725/another-justin-sun-s-project-is-hacked-over-113-million-lost","name":"","type":"other","credibility":3},{"url":"https://www.cnbc.com/2023/11/23/htx-heco-chain-crypto-hack-115-million-stolen-so-far.html","name":"","type":"other","credibility":3}],"severity":"medium"},{"content":"No meaningful portion of the $86.6 million stolen from the Heco Bridge was recovered or returned by the attacker. The 5% white-hat bounty offer from Justin Sun went unanswered. According to Elliptic, the stolen assets remained dormant in attacker-controlled wallets from November 2023 until March 13, 2024 — a holding period of approximately four months consistent with Lazarus Group operational patterns designed to reduce blockchain tracing attention before laundering. Beginning March 13, 2024, the attacker began routing the stolen ETH through the Tornado Cash mixing service. Elliptic reported that more than $100 million in ETH from the combined HTX/HECO thefts had been laundered through Tornado Cash as of March 15, 2024. The Block reported that the Heco Bridge exploiters laundered over $145 million via Tornado Cash within approximately eight days of laundering commencing. Elliptic attributed the shift back to Tornado Cash — which Lazarus had previously avoided after U.S. OFAC sanctions in August 2022 — to the seizure of their preferred alternative mixer Sinbad.io by U.S. authorities in November 2023. Unlike centralized mixers, Tornado Cash operates via immutable smart contracts and cannot be seized. A separate CoinDesk report citing Elliptic noted that Lazarus Group sent over 40 transactions to Tornado Cash on March 13 and 14, 2024 alone, laundering approximately $12 million in that initial window. Aggregate laundering estimates across multiple reports range from $100 million to $147.5 million routed through Tornado Cash from the combined HTX/HECO pool. No funds have been publicly confirmed as recovered or returned to users.","heading":"Recovery and Laundering Activity","sources":[{"url":"https://www.elliptic.co/blog/north-korean-hackers-return-to-tornado-cash-despite-sanctions","name":"","type":"other","credibility":3},{"url":"https://www.coindesk.com/business/2024/03/14/north-korean-hackers-used-tornado-cash-to-launder-12m-from-heco-bridge-hack-elliptic","name":"","type":"other","credibility":3},{"url":"https://crypto.news/heco-bridge-tornado-cash-hack/","name":"","type":"other","credibility":3},{"url":"https://www.investing.com/news/cryptocurrency-news/justin-sun-pledges-to-reimburse-htx-users-after-866-million-heco-chain-exploit-93CH-3241877","name":"","type":"other","credibility":3}],"severity":"medium"},{"content":"Heco Bridge presents an extreme risk profile. The bridge is permanently defunct: the HECO Network was officially shut down on January 15, 2025, approximately 14 months after the exploit. Any funds remaining on HECO Chain or in the bridge contract after that date are considered unrecoverable. The root cause — a single centralized operator private key controlling all bridge withdrawals — represented a severe architectural flaw. There was no multi-signature requirement, no time-lock, and no on-chain circuit-breaker that could have limited damage once the key was compromised. Elliptic's attribution to North Korea's Lazarus Group, if accurate, places this attack within a pattern of state-sponsored theft that has no realistic recovery path; North Korean-linked hackers have historically returned zero funds across most major exploits. The broader Justin Sun platform pattern — four hacks across affiliated platforms in two months totaling over $200 million — suggests systemic operational security deficiencies across the HTX/Tron/Poloniex ecosystem rather than an isolated incident. Users who held assets on HECO Chain at the time of the hack or the subsequent shutdown and did not withdraw in time to the January 10, 2025 deadline are likely to have suffered total or near-total losses. The protocol should be considered permanently closed and maximally risky for any residual interaction.","heading":"Risk Assessment","sources":[{"url":"https://blockonomi.com/heco-chain-announces-january-2025-closure-users-urged-to-redeem-assets/","name":"","type":"other","credibility":3},{"url":"https://coinmarketcap.com/academy/article/52cb9dfd-1370-47cc-a30e-dc3a67bbcd9a","name":"","type":"other","credibility":3},{"url":"https://cointelegraph.com/news/justin-sun-platforms-hacked-4-times","name":"","type":"other","credibility":3},{"url":"https://www.certik.com/resources/blog/heco-bridge-exploit","name":"","type":"other","credibility":3}],"severity":"medium"}],"timeline":[{"date":"2020-12-21","event":"HECO Chain (Huobi Eco Chain) officially launches with a $200 million ecosystem fund; Heco Bridge goes live enabling cross-chain transfers between HECO and Ethereum.","source":""},{"date":"2021-06","event":"HECO Chain TVL peaks at approximately $3 billion.","source":"","date_original":"2021-06-01"},{"date":"2023-11-10","event":"Poloniex, a Justin Sun-affiliated exchange, is hacked for approximately $120 million in a suspected private key compromise attributed to Lazarus Group.","source":""},{"date":"2023-11-22","event":"Heco Bridge operator private key is compromised; approximately $86.6 million in USDT, ETH, HBTC, SHIB, and other tokens drained to attacker address 0xfc146d1caf6ba1d1ce6dcb5b35dcbf895f50b0c4. Simultaneously, HTX hot wallets lose approximately $12.5 million.","source":""},{"date":"2023-11-22","event":"Justin Sun confirms the exploit on social media, pledges full compensation for HTX hot wallet losses, and offers a 5% white-hat bounty to the attacker.","source":""},{"date":"2023-11-22","event":"CertiK, Hacken, and ImmuneBytes publish post-mortem analyses attributing the attack to a private key compromise of the bridge operator account.","source":""},{"date":"2023-11-23","event":"CNBC reports combined HTX/HECO losses have reached approximately $115 million; services remain suspended.","source":""},{"date":"2024-03-13","event":"Stolen funds begin moving for the first time since the November 2023 attack; Lazarus Group routes ETH through Tornado Cash mixer with over 40 transactions in the first two days.","source":""},{"date":"2024-03-14","event":"Elliptic publishes analysis attributing the Heco Bridge and HTX hack to North Korea's Lazarus Group; reports over $100 million laundered through Tornado Cash.","source":""},{"date":"2024-03-22","event":"The Block and Crypto.news report that Heco Bridge exploiters have laundered over $145 million via Tornado Cash within approximately eight days.","source":""},{"date":"2024-11-20","event":"HTX announces scheduled permanent shutdown of the HECO Network effective January 15, 2025; users urged to redeem HRC20 assets before January 10, 2025.","source":""},{"date":"2025-01-15","event":"HECO Network officially ceases all operations. Heco Bridge is permanently defunct.","source":""}],"sources_used":[{"url":"https://www.prnewswire.com/news-releases/huobi-announces-early-access-to-huobi-eco-chain-an-ethereum-compatible-public-chain-for-blockchain-developers-301190736.html","name":"","type":"other","archive_url":"https://web.archive.org/web/20260830010037/https://www.prnewswire.com/news-releases/huobi-announces-early-access-to-huobi-eco-chain-an-ethereum-compatible-public-chain-for-blockchain-developers-301190736.html","credibility":3,"archive_timestamp":"2026-08-30T01:00:37+00:00"},{"url":"https://pontem.network/posts/a-deep-dive-into-the-heco-chain","name":"","type":"other","archive_url":"http://web.archive.org/web/20260612103911/https://pontem.network/posts/a-deep-dive-into-the-heco-chain","credibility":3,"archive_timestamp":"2026-06-12T10:39:11+00:00"},{"url":"https://coinmarketcap.com/academy/article/52cb9dfd-1370-47cc-a30e-dc3a67bbcd9a","name":"","type":"other","archive_url":null,"credibility":3,"archive_error":"error:not-found","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://rekt.news/heco-htx-rekt","name":"","type":"other","archive_url":"http://web.archive.org/web/20260518002950/https://rekt.news/heco-htx-rekt","credibility":3,"archive_timestamp":"2026-05-18T00:29:50+00:00"},{"url":"https://hacken.io/insights/heco-bridge-hack-explained/","name":"","type":"other","archive_url":"http://web.archive.org/web/20260520141729/https://hacken.io/insights/heco-bridge-hack-explained/","credibility":3,"archive_timestamp":"2026-05-20T14:17:29+00:00"},{"url":"https://immunebytes.com/blog/heco-bridge-exploited-for-over-87m-in-a-suspected-private-key-leak/","name":"","type":"other","archive_url":"http://web.archive.org/web/20251107210828/https://immunebytes.com/blog/heco-bridge-exploited-for-over-87m-in-a-suspected-private-key-leak/","credibility":3,"archive_timestamp":"2025-11-07T21:08:28+00:00"},{"url":"https://www.certik.com/resources/blog/heco-bridge-exploit","name":"","type":"other","archive_url":"http://web.archive.org/web/20251207052708/https://www.certik.com/resources/blog/heco-bridge-exploit","credibility":3,"archive_timestamp":"2025-12-07T05:27:08+00:00"},{"url":"https://blockworks.co/news/htx-hack-ethereum-crypto-assets","name":"","type":"other","archive_url":"http://web.archive.org/web/20260222040442/https://blockworks.co/news/htx-hack-ethereum-crypto-assets","credibility":3,"archive_timestamp":"2026-02-22T04:04:42+00:00"},{"url":"https://olympixai.medium.com/heco-bridge-hack-analysis-64cffda76684","name":"","type":"other","archive_url":"http://web.archive.org/web/20260203031954/https://olympixai.medium.com/heco-bridge-hack-analysis-64cffda76684","credibility":3,"archive_timestamp":"2026-02-03T03:19:54+00:00"},{"url":"https://cointelegraph.com/news/justin-sun-platforms-hacked-4-times","name":"","type":"other","archive_url":"http://web.archive.org/web/20260318124534/https://cointelegraph.com/news/justin-sun-platforms-hacked-4-times","credibility":3,"archive_timestamp":"2026-03-18T12:45:34+00:00"},{"url":"https://www.coindesk.com/tech/2023/11/22/justin-sun-confirms-htx-heco-chain-exploited-after-100m-in-suspicious-transfers","name":"","type":"other","archive_url":"http://web.archive.org/web/20260725211244/https://www.coindesk.com/tech/2023/11/22/justin-sun-confirms-htx-heco-chain-exploited-after-100m-in-suspicious-transfers","credibility":3,"archive_timestamp":"2026-07-25T21:12:44+00:00"},{"url":"https://coinpaper.com/2725/another-justin-sun-s-project-is-hacked-over-113-million-lost","name":"","type":"other","archive_url":"http://web.archive.org/web/20260612211731/https://coinpaper.com/2725/another-justin-sun-s-project-is-hacked-over-113-million-lost","credibility":3,"archive_timestamp":"2026-06-12T21:17:31+00:00"},{"url":"https://www.cnbc.com/2023/11/23/htx-heco-chain-crypto-hack-115-million-stolen-so-far.html","name":"","type":"other","archive_url":"http://web.archive.org/web/20260522060819/https://www.cnbc.com/2023/11/23/htx-heco-chain-crypto-hack-115-million-stolen-so-far.html","credibility":3,"archive_timestamp":"2026-05-22T06:08:19+00:00"},{"url":"https://www.elliptic.co/blog/north-korean-hackers-return-to-tornado-cash-despite-sanctions","name":"","type":"other","archive_url":"http://web.archive.org/web/20260519161533/https://www.elliptic.co/blog/north-korean-hackers-return-to-tornado-cash-despite-sanctions","credibility":3,"archive_timestamp":"2026-05-19T16:15:33+00:00"},{"url":"https://www.coindesk.com/business/2024/03/14/north-korean-hackers-used-tornado-cash-to-launder-12m-from-heco-bridge-hack-elliptic","name":"","type":"other","archive_url":"http://web.archive.org/web/20260725211153/https://www.coindesk.com/business/2024/03/14/north-korean-hackers-used-tornado-cash-to-launder-12m-from-heco-bridge-hack-elliptic","credibility":3,"archive_timestamp":"2026-07-25T21:11:53+00:00"},{"url":"https://crypto.news/heco-bridge-tornado-cash-hack/","name":"","type":"other","archive_url":"http://web.archive.org/web/20251008061430/https://crypto.news/heco-bridge-tornado-cash-hack/","credibility":3,"archive_timestamp":"2025-10-08T06:14:30+00:00"},{"url":"https://www.investing.com/news/cryptocurrency-news/justin-sun-pledges-to-reimburse-htx-users-after-866-million-heco-chain-exploit-93CH-3241877","name":"","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://blockonomi.com/heco-chain-announces-january-2025-closure-users-urged-to-redeem-assets/","name":"","type":"other","archive_url":"http://web.archive.org/web/20260726134724/https://blockonomi.com/heco-chain-announces-january-2025-closure-users-urged-to-redeem-assets/","credibility":3,"archive_timestamp":"2026-07-26T13:47:24+00:00"}],"source_tags":["defillama"],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-sonnet-4-6","created_at":"2026-05-04T02:54:36.684655+00:00","updated_at":"2026-08-30T01:16:29.202048+00:00"}}