{"investigation":{"slug":"heco-bridge-htx","entity_name":"HECO Bridge & HTX Exchange Hack","trust_score":1,"severity_base":null,"score_modifier":-7,"confidence":0.91,"status":"published","content_type":"investigation","summary":"On November 22, 2023, the HECO Chain cross-chain bridge and the HTX exchange (formerly Huobi), both linked to entrepreneur Justin Sun, were exploited at around the same time. The bridge lost approximately $87 million in various tokens and HTX hot wallets lost a further $12.5-26 million, with combined losses reported between about $99 million and $113 million; security firms attributed the bridge theft to an operator private key compromise, and Elliptic alleged the attack was the work of North Korea's Lazarus Group, which began laundering through Tornado Cash in March 2024. No meaningful recovery has been confirmed, and HECO Chain was shut down on January 15, 2025.","sections":[{"content":"On November 22, 2023, the HECO Chain cross-chain bridge and the HTX exchange (formerly Huobi), both linked to entrepreneur Justin Sun, were exploited at around the same time. On-chain security monitoring detected anomalous outflows from the bridge and from HTX hot wallets; one account puts the start at approximately 21:00 UTC and another at approximately 10:00 UTC.\n\nHECO bridge: per the more detailed token list, the bridge was drained of 10,145 ETH, 42,110,000 USDT, 489 HBTC, 346,867,120,000 SHIB, 173,200 UNI, 619,000 USDC, 42,399 LINK and 346,994 TUSD, totalling approximately $87 million (another account gives $86.6 million, with ETH valued at roughly $19 million, HBTC roughly $18.8 million and SHIB roughly $2.8 million). Stolen tokens were swapped to ETH on decentralized exchanges.\n\nHTX hot wallets: HTX hot wallets on Ethereum and TRON were reported drained of approximately $13.6 million and $12.6 million respectively, about $26 million in total; the other account gives roughly $12.5 million in ETH, USDT, USDC and LINK.\n\nCombined totals therefore differ by source: approximately $113 million (HECO bridge plus HTX, per CoinDesk-based reporting), approximately $99 million (the other account), and approximately $115 million reported by CNBC on November 23, 2023. CertiK's analysis found all bridge transactions originated from the bridge operator wallet 0x3d655889D197125fb90dcB72e4a287A8410ED1B9, calling the privileged withdrawToken function.","heading":"The November 22, 2023 Simultaneous Exploits","sources":[{"url":"https://www.certik.com/resources/blog/heco-bridge-exploit","name":"CertiK — Heco Bridge Exploit","type":"research","credibility":2},{"url":"https://blockworks.co/news/htx-hack-ethereum-crypto-assets","name":"Blockworks — Heco chain bridge drained of $87M","type":"news_article","credibility":2},{"url":"https://www.coindesk.com/tech/2023/11/22/justin-sun-confirms-htx-heco-chain-exploited-after-100m-in-suspicious-transfers","name":"CoinDesk — Justin Sun Confirms HTX, Heco Chain Exploited","type":"news_article","credibility":2},{"url":"https://immunebytes.com/blog/heco-bridge-exploited-for-over-87m-in-a-suspected-private-key-leak/","name":"ImmuneBytes — HECO Bridge Exploited for Over $87M","type":"research","credibility":2},{"url":"https://rekt.news/heco-htx-rekt","name":"Rekt News — Heco / HTX","type":"research","credibility":3},{"url":"https://hacken.io/insights/heco-bridge-hack-explained/","name":"Hacken — Heco Bridge Hack Explained","type":"research","credibility":2},{"url":"https://www.cnbc.com/2023/11/23/htx-heco-chain-crypto-hack-115-million-stolen-so-far.html","name":"CNBC — HTX, Heco Chain crypto hack: $115 million stolen so far","type":"news_article","credibility":3},{"url":"https://coinpaper.com/2725/another-justin-sun-s-project-is-hacked-over-113-million-lost","name":"Coinpaper — Another Justin Sun project is hacked, over $113 million lost","type":"news_article","credibility":3},{"url":"https://cointelegraph.com/news/htx-exchange-loses-14-million-hot-wallet-hack","name":"CoinTelegraph — HTX exchange loses $13.6M in hot wallet hack","type":"news_article","credibility":2}],"severity":"critical"},{"content":"CertiK, Hacken, and ImmuneBytes each independently assessed that the HECO bridge operator wallet was compromised through a private key leak rather than a smart contract vulnerability. The withdrawToken function is restricted to a single privileged operator address, so possession of that key allowed arbitrary token withdrawals with no further on-chain constraints. How the key was exfiltrated, whether by phishing, insider access, or infrastructure compromise, has not been publicly confirmed by HTX or the HECO development team.\n\nCommentators noted the bridge's centralized operator model as a single point of failure: there was reportedly no multi-signature requirement, no time-lock, and no on-chain circuit-breaker that could have limited the damage. The REKT News post-mortem noted that PeckShield had previously flagged that vulnerabilities from prior hacks may have been reused. The rapid conversion of stolen tokens to ETH was described as a laundering pattern characteristic of sophisticated state-sponsored actors.","heading":"Root Cause: Operator Private Key Compromise","sources":[{"url":"https://hacken.io/insights/heco-bridge-hack-explained/","name":"Hacken — Heco Bridge Hack Explained","type":"research","credibility":2},{"url":"https://www.certik.com/resources/blog/heco-bridge-exploit","name":"CertiK — Heco Bridge Exploit","type":"research","credibility":2},{"url":"https://immunebytes.com/blog/heco-bridge-exploited-for-over-87m-in-a-suspected-private-key-leak/","name":"ImmuneBytes — HECO Bridge Exploited for Over $87M","type":"research","credibility":2},{"url":"https://olympixai.medium.com/heco-bridge-hack-analysis-64cffda76684","name":"Olympix — Heco Bridge Hack Analysis","type":"research","credibility":2},{"url":"https://rekt.news/heco-htx-rekt","name":"Rekt News — Heco / HTX","type":"research","credibility":3}],"severity":"critical"},{"content":"Addresses identified in the inputs: the compromised bridge operator wallet 0x3d655889d197125fb90dcb72e4a287a8410ed1b9 called withdrawToken on the bridge contract 0xa929022c9107643515f5c777ce9a910f0d1e490c, routing assets to the attacker accumulation address 0xfc146d1caf6ba1d1ce6dcb5b35dcbf895f50b0c4. Approximately $63 million was concentrated in holding address 0xe47e6dA16Bb83EB0FD26b3F29b15CE8Fab089B9e, labelled 'Heco Bridge Exploiter 2', which distributed 23,574 ETH across four secondary wallets. Additional attacker-linked addresses identified by Hacken: 0x6a40dfe3008bc3f99907e6dff4d041f933493411, 0x640e567a5041c7108033dadb0b47a3f7aedd661b, 0x945647f6225a44e35a0ea50f9fe2b4321794aa29, 0x153d99836e197f92a8385ba80afbb57b69de2cc1, and 0x7abd8dda6cca1785af2f812b171b98d6924ff5d2.\n\nOn the HTX side, hot wallets 0xb9f775179bcc7fcf4534700a48f09c590e390ead and 0x9281035df6f00557c0285d7df21d323c2e2f99ad were drained, with proceeds received by attacker wallets 0x5a22f867dfcb4f32d25a5fa365b9d9d78d5515dc (ETH) and 0x121a0ff24027fffcdd0ae008da82f2789c7945cc (other assets). The inputs are not fully consistent on the role of 0xe47e...9B9e: one page calls it both the main exploiter wallet and a separate holding address, while the other treats 0xfc14...b0c4 as the primary attacker address and 0xe47e...9B9e as the consolidation address for roughly $63 million.","heading":"On-Chain Evidence and Addresses","sources":[{"url":"https://hacken.io/insights/heco-bridge-hack-explained/","name":"Hacken — Heco Bridge Hack Explained","type":"research","credibility":2},{"url":"https://rekt.news/heco-htx-rekt","name":"Rekt News — Heco / HTX","type":"research","credibility":3},{"url":"https://olympixai.medium.com/heco-bridge-hack-analysis-64cffda76684","name":"Olympix — Heco Bridge Hack Analysis","type":"research","credibility":2},{"url":"https://www.certik.com/resources/blog/heco-bridge-exploit","name":"CertiK — Heco Bridge Exploit","type":"research","credibility":2}],"severity":"high"},{"content":"Blockchain intelligence firm Elliptic attributed the HECO bridge and HTX hack to North Korea's Lazarus Group, citing behavioral attributes of the hack and fund movements consistent with prior Lazarus operations. The attribution has not been officially confirmed by U.S. agencies such as the FBI or OFAC as of the time of writing and should be treated as alleged.\n\nThe stolen funds were reported dormant for approximately three months (one account) or four months (another) before laundering began on March 13, 2024. Reported laundering figures differ: Elliptic reported more than $100 million in ETH from the combined HTX/HECO thefts laundered through Tornado Cash as of March 15, 2024; The Block, CoinTelegraph and Crypto.news reported over $145 million processed within about eight days; CoinDesk, citing Elliptic, reported approximately $12 million laundered in an initial window (over 40 transactions to Tornado Cash on March 13 and 14, 2024), which one account describes as a distinct Lazarus-attributed tranche and the other as the initial window of the same laundering; aggregate estimates range from $100 million to $147.5 million.\n\nElliptic attributed Lazarus's return to Tornado Cash, which the U.S. Treasury sanctioned in August 2022, to the limited availability of alternative large-scale mixers after law enforcement seizures of Sinbad.io and Blender.io in late 2023. Unlike centralized mixers, Tornado Cash runs on immutable smart contracts and cannot be seized.","heading":"Lazarus Group Attribution and Laundering","sources":[{"url":"https://www.elliptic.co/blog/north-korean-hackers-return-to-tornado-cash-despite-sanctions","name":"Elliptic — North Korean Hackers Return to Tornado Cash","type":"research","credibility":2},{"url":"https://www.coindesk.com/business/2024/03/14/north-korean-hackers-used-tornado-cash-to-launder-12m-from-heco-bridge-hack-elliptic","name":"CoinDesk — North Korean Hackers Used Tornado Cash to Launder $12M from Heco Bridge Hack","type":"news_article","credibility":2},{"url":"https://www.theblock.co/post/284107/heco-bridge-exploiters-launder-145-million-usd-eth-tornado-cash","name":"The Block — Heco Bridge exploiters launder over $145 million via Tornado Cash","type":"news_article","credibility":2},{"url":"https://cointelegraph.com/news/heco-exploiter-anonymizes-145-m-ether-tornado-cash","name":"CoinTelegraph — HECO Chain exploiter anonymizes $145M of Ether on Tornado Cash","type":"news_article","credibility":2},{"url":"https://crypto.news/heco-bridge-tornado-cash-hack/","name":"Crypto.news — Heco Bridge Tornado Cash","type":"news_article","credibility":3}],"severity":"critical"},{"content":"No meaningful portion of the approximately $86.6-87 million stolen from the HECO bridge has been publicly confirmed as recovered or returned to users. According to one account, Justin Sun offered the attacker a 5% white-hat bounty shortly after the attack, which was not accepted; the other input page does not mention such an offer for this incident (it mentions a 5% bounty accepted in the September 2023 HTX hack and a $10 million bounty offered after the Poloniex hack). Independent verification of actual compensation disbursements to affected HECO bridge users has not been publicly documented in audited form. Given the Lazarus attribution, commentators noted that North Korean-linked hackers have historically returned few or no funds.","heading":"Fund Recovery","sources":[{"url":"https://rekt.news/heco-htx-rekt","name":"Rekt News — Heco / HTX","type":"research","credibility":3},{"url":"https://www.elliptic.co/blog/north-korean-hackers-return-to-tornado-cash-despite-sanctions","name":"Elliptic — North Korean Hackers Return to Tornado Cash","type":"research","credibility":2},{"url":"https://www.coindesk.com/tech/2023/11/22/justin-sun-confirms-htx-heco-chain-exploited-after-100m-in-suspicious-transfers","name":"CoinDesk — Justin Sun Confirms HTX, Heco Chain Exploited","type":"news_article","credibility":2},{"url":"https://www.investing.com/news/cryptocurrency-news/justin-sun-pledges-to-reimburse-htx-users-after-866-million-heco-chain-exploit-93CH-3241877","name":"Investing.com — Justin Sun pledges to reimburse HTX users after $86.6 million HECO Chain exploit","type":"news_article","credibility":3},{"url":"https://cointelegraph.com/news/justin-sun-platforms-hacked-4-times","name":"CoinTelegraph — Justin Sun platforms hacked four times","type":"news_article","credibility":3}],"severity":"high"},{"content":"The November 22 attack occurred within a broader pattern of security failures across platforms associated with Justin Sun. On September 24, 2023, HTX (recently rebranded from Huobi) lost 5,000 ETH (approximately $8 million) in a hot wallet compromise; the hacker returned 4,997 ETH on about October 7, 2023 after accepting a 5% white-hat bounty of 250 ETH (about $410,000), leaving an on-chain message confirming a private key leak as the root cause. On November 10, 2023, twelve days before the HECO/HTX attack, Sun's Poloniex exchange was exploited for approximately $120-126 million, attributed to a hot wallet compromise (one account also attributes it to the Lazarus Group), and a $10 million white-hat bounty was offered.\n\nCumulative losses are put at over $240 million across three incidents (September HTX, November Poloniex, November HECO/HTX) within about two months in one account, and at over $200 million across three platforms (HTX, Heco Bridge, Poloniex) in another; CoinTelegraph reported Sun-related platforms had been hacked four times in two months. Researchers cited the recurring private key failures as suggesting systemic key-management deficiencies rather than isolated incidents. CertiK noted the HECO incident contributed to a 2023 total of over $800 million lost to private key compromises, 56% of all funds lost to crypto exploits that year.","heading":"Pattern of Security Incidents Across Justin Sun's Ecosystem","sources":[{"url":"https://www.halborn.com/blog/post/explained-the-huobi-exchange-hack-september-2023","name":"Halborn — Explained: The Huobi Exchange Hack (September 2023)","type":"research","credibility":2},{"url":"https://www.coindesk.com/business/2023/09/25/crypto-exchange-htx-lost-8m-of-ether-due-to-a-hack-justin-sun-says","name":"CoinDesk — Crypto Exchange HTX Lost $8M of Ether Due to a Hack, Justin Sun Says","type":"news_article","credibility":2},{"url":"https://decrypt.co/205465/justin-sun-owned-crypto-exchange-poloniex-hacked-60m","name":"Decrypt — Justin Sun-Owned Exchange Poloniex Hacked for At Least $126 Million","type":"news_article","credibility":2},{"url":"https://www.scmp.com/tech/big-tech/article/3242535/crypto-exchange-htx-suffers-us30-million-hack-after-another-platform-linked-entrepreneur-justin-sun","name":"South China Morning Post — Crypto exchange HTX suffers US$30 million hack","type":"news_article","credibility":2},{"url":"https://cointelegraph.com/news/justin-sun-platforms-hacked-4-times","name":"CoinTelegraph — Justin Sun platforms hacked four times","type":"news_article","credibility":3},{"url":"https://www.bitcoininsider.org/article/228781/htx-huobi-hacker-returns-8-million-stolen-crypto-and-leaves-message-behind","name":"Bitcoin Insider — HTX/Huobi hacker returns $8 million stolen crypto","type":"news_article","credibility":2},{"url":"https://www.certik.com/resources/blog/heco-bridge-exploit","name":"CertiK — Heco Bridge Exploit","type":"research","credibility":2}],"severity":"high"},{"content":"Justin Sun publicly confirmed both exploits on November 22, 2023, via social media, stating that 'HTX will fully compensate for any losses originating from the exchange' and that remaining funds in HTX were secured. He said HTX and HECO Chain 'operate independently' while acknowledging the simultaneous attacks. One account notes he did not make an equivalent blanket pledge for the bridge losses. HTX suspended deposits and withdrawals and resumed services on November 25, 2023, about three days after the hack. Despite the pledge, HTX recorded about $258 million in net outflows between November 25 and December 10, 2023. Sun made a similar compensation pledge after the Poloniex hack. The bridge and HECO Chain services were suspended pending investigation.","heading":"Justin Sun's Response and Compensation Pledges","sources":[{"url":"https://www.coindesk.com/tech/2023/11/22/justin-sun-confirms-htx-heco-chain-exploited-after-100m-in-suspicious-transfers","name":"CoinDesk — Justin Sun Confirms HTX, Heco Chain Exploited","type":"news_article","credibility":2},{"url":"https://ng.investing.com/news/stock-market-news/justin-sun-pledges-to-reimburse-htx-users-after-866-million-heco-chain-exploit-93CH-1150520","name":"Investing.com — Justin Sun pledges to reimburse HTX users after $86.6 million HECO Chain exploit","type":"news_article","credibility":2},{"url":"https://www.investing.com/news/cryptocurrency-news/justin-sun-pledges-to-reimburse-htx-users-after-866-million-heco-chain-exploit-93CH-3241877","name":"Investing.com — Justin Sun pledges to reimburse HTX users after $86.6 million HECO Chain exploit","type":"news_article","credibility":3},{"url":"https://cointelegraph.com/news/crypto-exchange-htx-outflow-258-million-hack-november","name":"CoinTelegraph — Crypto exchange HTX sees outflows top $258M following exploit","type":"news_article","credibility":2},{"url":"https://www.bankinfosecurity.com/cryptohack-roundup-87-million-heco-hack-a-23679","name":"BankInfoSecurity — Cryptohack Roundup: Heco Loses $87 Million to Hack Attack","type":"news_article","credibility":2},{"url":"https://cointelegraph.com/news/htx-huobi-bitcoin-withdrawal-deposit-back-after-hot-wallet-hack","name":"CoinTelegraph — HTX deposits and withdrawals back after hot wallet hack","type":"news_article","credibility":2}],"severity":"high"},{"content":"Huobi Eco Chain (HECO) launched on December 21, 2020 as an EVM-compatible Layer 1 blockchain using a Hybrid Proof of Stake consensus combining Proof of Authority and Proof of Stake. Huobi DeFi Labs announced a $200 million ecosystem fund, and the network's total value locked peaked at roughly $3 billion in 2021. The Heco Bridge was the native cross-chain bridge between HECO Chain and Ethereum for assets including BTC, ETH and stablecoins, operated by HTX (formerly Huobi). In 2022, Tron founder Justin Sun became a prominent backer and advisor to HTX. By late 2023, amid competition from other L1 chains and a prolonged market downturn, HECO's activity had declined materially.","heading":"HECO Chain and Bridge Background","sources":[{"url":"https://www.prnewswire.com/news-releases/huobi-announces-early-access-to-huobi-eco-chain-an-ethereum-compatible-public-chain-for-blockchain-developers-301190736.html","name":"PR Newswire — Huobi Announces Early Access to Huobi Eco Chain","type":"official","credibility":3},{"url":"https://pontem.network/posts/a-deep-dive-into-the-heco-chain","name":"Pontem Network — A Deep Dive into the HECO Chain","type":"research","credibility":3},{"url":"https://coinmarketcap.com/academy/article/52cb9dfd-1370-47cc-a30e-dc3a67bbcd9a","name":"CoinMarketCap Academy — HECO Chain article","type":"research","credibility":3}],"severity":"medium"},{"content":"HTX announced that HECO Chain would permanently cease operations on January 15, 2025, ending about four years of operation; the announcement is dated November 25, 2024 in one account and November 20, 2024 in another. The stated rationale was the 'prolonged market downturn and steady growth of competitors' including Ethereum, Solana, BSC, Avalanche and TRON. Analysts noted the November 2023 hack had accelerated the platform's decline by damaging user confidence. Users holding HRC20 assets (including HRC20ETH, HRC20USDT, HRC20LINK, HRC20USDC, HRC20UNI, HRC20SHIB, HRC20HBTC and HRC20TUSD) had to deposit holdings to a designated address before January 10, 2025, for conversion into points redeemable for HTX tokens in 12 tranches. One account describes the closure as the first major blockchain infrastructure closure directly traceable to a security incident of this magnitude in the HECO ecosystem. Users who did not withdraw by the deadline and any funds left on HECO Chain or in the bridge contract are likely to have suffered total or near-total losses; the bridge should be considered permanently closed.","heading":"HECO Chain Shutdown (January 2025)","sources":[{"url":"https://blockonomi.com/heco-chain-announces-january-2025-closure-users-urged-to-redeem-assets/","name":"Blockonomi — HECO Chain Announces January 2025 Closure","type":"news_article","credibility":2},{"url":"https://dapp.expert/news/en_heco-to-officially-shutdown-in-january-2025-key-information-for-users","name":"Dapp.expert — HECO to Officially Shutdown in January 2025","type":"news_article","credibility":3},{"url":"https://coinmarketcap.com/academy/article/52cb9dfd-1370-47cc-a30e-dc3a67bbcd9a","name":"CoinMarketCap Academy — HECO Chain article","type":"research","credibility":3},{"url":"https://www.certik.com/resources/blog/heco-bridge-exploit","name":"CertiK — Heco Bridge Exploit","type":"research","credibility":2}],"severity":"high"},{"content":"On March 22, 2023, about eight months before the HECO/HTX hack, the U.S. Securities and Exchange Commission filed charges against Justin Sun and three of his companies (Tron Foundation Limited, BitTorrent Foundation Ltd., and Rainberry Inc.) for the alleged unregistered offer and sale of crypto asset securities TRX and BTT, fraudulent wash trading to manipulate TRX secondary markets, and undisclosed celebrity promotion schemes. The complaint was filed in the U.S. District Court for the Southern District of New York. Sun and the SEC later entered preliminary settlement discussions that paused the litigation. These are allegations; the pre-existing scrutiny added legal and reputational complexity to HTX's response to the incidents.","heading":"Regulatory Context: SEC Charges Against Justin Sun","sources":[{"url":"https://www.sec.gov/newsroom/press-releases/2023-59","name":"SEC.gov — SEC Charges Crypto Entrepreneur Justin Sun and His Companies for Fraud","type":"regulatory","credibility":1},{"url":"https://www.coindesk.com/policy/2023/03/22/tron-founder-justin-sun-sued-by-us-sec-on-securities-market-manipulation-charges","name":"CoinDesk — Tron Founder Justin Sun Sued by U.S. SEC","type":"news_article","credibility":1},{"url":"https://thedefiant.io/news/regulation/sec-and-justin-sun-pause-tron-fraud-lawsuit-for-settlement-talks","name":"The Defiant — SEC and Justin Sun Pause Tron Fraud Lawsuit for Settlement Talks","type":"news_article","credibility":2}],"severity":"high"}],"timeline":[{"date":"2020-12","event":"HECO Chain (Huobi Eco Chain) officially launches (December 21, 2020) with a $200 million ecosystem fund; Heco Bridge goes live enabling cross-chain transfers between HECO and Ethereum.","source":""},{"date":"2021-06","event":"HECO Chain TVL peaks at approximately $3 billion.","source":""},{"date":"2023-09","event":"HTX (formerly Huobi) hot wallet exploited for 5,000 ETH (~$8 million) on September 24, 2023. Justin Sun offers a 5% white-hat bounty.","source":"CoinDesk — Crypto Exchange HTX Lost $8M of Ether Due to a Hack, Justin Sun Says","source_url":"https://www.coindesk.com/business/2023/09/25/crypto-exchange-htx-lost-8m-of-ether-due-to-a-hack-justin-sun-says"},{"date":"2023-10","event":"September HTX hacker returns 4,997 ETH (about October 7, 2023) after receiving a 250 ETH (~$410,000) white-hat bounty; an on-chain message confirms a private key leak as root cause.","source":"Bitcoin Insider — HTX/Huobi hacker returns $8 million stolen crypto","source_url":"https://www.bitcoininsider.org/article/228781/htx-huobi-hacker-returns-8-million-stolen-crypto-and-leaves-message-behind"},{"date":"2023-11","event":"Justin Sun-owned Poloniex exchange hacked on November 10, 2023 for approximately $120-126 million via hot wallet compromise; $10 million white-hat bounty offered.","source":"Decrypt — Justin Sun-Owned Exchange Poloniex Hacked for At Least $126 Million","source_url":"https://decrypt.co/205465/justin-sun-owned-crypto-exchange-poloniex-hacked-60m"},{"date":"2023-11","event":"November 22, 2023: HECO Chain cross-chain bridge exploited for approximately $87 million via operator private key compromise; HTX hot wallets drained at the same time (about $12.5-26 million depending on source). Reported combined losses range from about $99 million to $113 million.","source":"CoinDesk — Justin Sun Confirms HTX, Heco Chain Exploited","source_url":"https://www.coindesk.com/tech/2023/11/22/justin-sun-confirms-htx-heco-chain-exploited-after-100m-in-suspicious-transfers"},{"date":"2023-11","event":"November 22, 2023: Justin Sun publicly confirms the exploits, pledges full compensation for HTX losses, and HTX suspends deposits and withdrawals. CertiK, Hacken and ImmuneBytes publish analyses attributing the bridge attack to an operator private key compromise.","source":"Investing.com — Justin Sun pledges to reimburse HTX users after $86.6 million HECO Chain exploit","source_url":"https://ng.investing.com/news/stock-market-news/justin-sun-pledges-to-reimburse-htx-users-after-866-million-heco-chain-exploit-93CH-1150520"},{"date":"2023-11","event":"November 23, 2023: CNBC reports combined HTX/HECO losses of approximately $115 million; services remain suspended.","source":"CNBC — HTX, Heco Chain crypto hack: $115 million stolen so far","source_url":"https://www.cnbc.com/2023/11/23/htx-heco-chain-crypto-hack-115-million-stolen-so-far.html"},{"date":"2023-11","event":"HTX resumes deposit and withdrawal services on November 25, 2023, about three days after the hack.","source":"CoinTelegraph — HTX deposits and withdrawals back after hot wallet hack","source_url":"https://cointelegraph.com/news/htx-huobi-bitcoin-withdrawal-deposit-back-after-hot-wallet-hack"},{"date":"2023-12","event":"HTX records approximately $258 million in net outflows (to December 10, 2023) since resuming services on November 25.","source":"CoinTelegraph — Crypto exchange HTX sees outflows top $258M following exploit","source_url":"https://cointelegraph.com/news/crypto-exchange-htx-outflow-258-million-hack-november"},{"date":"2024-03","event":"March 13, 2024: Lazarus Group (alleged) begins laundering HECO bridge/HTX hack proceeds through Tornado Cash, with over 40 transactions in the first two days. March 14: Elliptic attributes the hack to Lazarus Group and reports $12 million (and, per the other account, over $100 million) laundered via Tornado Cash. March 22: analysts report over $145 million in ETH laundered over an 8-day period.","source":"Elliptic — North Korean Hackers Return to Tornado Cash","source_url":"https://www.elliptic.co/blog/north-korean-hackers-return-to-tornado-cash-despite-sanctions"},{"date":"2024-11","event":"HTX announces permanent closure of HECO Chain effective January 15, 2025 (announcement dated November 20 or November 25, 2024 depending on source); users instructed to redeem HRC20 assets before January 10, 2025.","source":"Blockonomi — HECO Chain Announces January 2025 Closure","source_url":"https://blockonomi.com/heco-chain-announces-january-2025-closure-users-urged-to-redeem-assets/"},{"date":"2025-01","event":"HECO Chain officially shuts down on January 15, 2025 after about four years of operation; the Heco Bridge is permanently defunct.","source":"Blockonomi — HECO Chain Announces January 2025 Closure","source_url":"https://blockonomi.com/heco-chain-announces-january-2025-closure-users-urged-to-redeem-assets/"}],"sources_used":[{"url":"https://www.coindesk.com/tech/2023/11/22/justin-sun-confirms-htx-heco-chain-exploited-after-100m-in-suspicious-transfers","name":"CoinDesk — Justin Sun Confirms HTX, Heco Chain Exploited","type":"news_article","archive_url":"http://web.archive.org/web/20251223073850/https://www.coindesk.com/tech/2023/11/22/justin-sun-confirms-htx-heco-chain-exploited-after-100m-in-suspicious-transfers","credibility":2,"archive_timestamp":"2025-12-23T07:38:50+00:00"},{"url":"https://www.certik.com/resources/blog/heco-bridge-exploit","name":"CertiK — Heco Bridge Exploit","type":"research","archive_url":"http://web.archive.org/web/20251207052708/https://www.certik.com/resources/blog/heco-bridge-exploit","credibility":2,"archive_timestamp":"2025-12-07T05:27:08+00:00"},{"url":"https://hacken.io/insights/heco-bridge-hack-explained/","name":"Hacken — Heco Bridge Hack Explained","type":"research","archive_url":"http://web.archive.org/web/20260520141729/https://hacken.io/insights/heco-bridge-hack-explained/","credibility":2,"archive_timestamp":"2026-05-20T14:17:29+00:00"},{"url":"https://immunebytes.com/blog/heco-bridge-exploited-for-over-87m-in-a-suspected-private-key-leak/","name":"ImmuneBytes — HECO Bridge Exploited for Over $87M","type":"research","archive_url":"http://web.archive.org/web/20251107210828/https://immunebytes.com/blog/heco-bridge-exploited-for-over-87m-in-a-suspected-private-key-leak/","credibility":2,"archive_timestamp":"2025-11-07T21:08:28+00:00"},{"url":"https://blockworks.co/news/htx-hack-ethereum-crypto-assets","name":"Blockworks — Heco chain bridge drained of $87M","type":"news_article","archive_url":"http://web.archive.org/web/20260222040442/https://blockworks.co/news/htx-hack-ethereum-crypto-assets","credibility":2,"archive_timestamp":"2026-02-22T04:04:42+00:00"},{"url":"https://www.elliptic.co/blog/north-korean-hackers-return-to-tornado-cash-despite-sanctions","name":"Elliptic — North Korean Hackers Return to Tornado Cash","type":"research","archive_url":"http://web.archive.org/web/20260519161533/https://www.elliptic.co/blog/north-korean-hackers-return-to-tornado-cash-despite-sanctions","credibility":2,"archive_timestamp":"2026-05-19T16:15:33+00:00"},{"url":"https://www.coindesk.com/business/2024/03/14/north-korean-hackers-used-tornado-cash-to-launder-12m-from-heco-bridge-hack-elliptic","name":"CoinDesk — North Korean Hackers Used Tornado Cash to Launder $12M from Heco Bridge Hack","type":"news_article","archive_url":"http://web.archive.org/web/20260725211153/https://www.coindesk.com/business/2024/03/14/north-korean-hackers-used-tornado-cash-to-launder-12m-from-heco-bridge-hack-elliptic","credibility":2,"archive_timestamp":"2026-07-25T21:11:53+00:00"},{"url":"https://www.theblock.co/post/284107/heco-bridge-exploiters-launder-145-million-usd-eth-tornado-cash","name":"The Block — Heco Bridge exploiters launder over $145 million via Tornado Cash","type":"news_article","archive_url":"http://web.archive.org/web/20250826180545/https://www.theblock.co/post/284107/heco-bridge-exploiters-launder-145-million-usd-eth-tornado-cash","credibility":2,"archive_timestamp":"2025-08-26T18:05:45+00:00"},{"url":"https://cointelegraph.com/news/heco-exploiter-anonymizes-145-m-ether-tornado-cash","name":"CoinTelegraph — HECO Chain exploiter anonymizes $145M of Ether on Tornado Cash","type":"news_article","archive_url":"http://web.archive.org/web/20260122020428/https://cointelegraph.com/news/heco-exploiter-anonymizes-145-m-ether-tornado-cash","credibility":2,"archive_timestamp":"2026-01-22T02:04:28+00:00"},{"url":"https://cointelegraph.com/news/crypto-exchange-htx-outflow-258-million-hack-november","name":"CoinTelegraph — Crypto exchange HTX sees outflows top $258M following exploit","type":"news_article","archive_url":"https://web.archive.org/web/20260726135102/https://cointelegraph.com/news/crypto-exchange-htx-outflow-258-million-hack-november","credibility":2,"archive_timestamp":"2026-07-26T13:51:02+00:00"},{"url":"https://cointelegraph.com/news/htx-exchange-loses-14-million-hot-wallet-hack","name":"CoinTelegraph — HTX exchange loses $13.6M in hot wallet hack","type":"news_article","archive_url":"http://web.archive.org/web/20250827103350/https://cointelegraph.com/news/htx-exchange-loses-14-million-hot-wallet-hack","credibility":2,"archive_timestamp":"2025-08-27T10:33:50+00:00"},{"url":"https://www.coindesk.com/business/2023/09/25/crypto-exchange-htx-lost-8m-of-ether-due-to-a-hack-justin-sun-says","name":"CoinDesk — Crypto Exchange HTX Lost $8M of Ether Due to a Hack, Justin Sun Says","type":"news_article","archive_url":"http://web.archive.org/web/20260727135415/https://www.coindesk.com/business/2023/09/25/crypto-exchange-htx-lost-8m-of-ether-due-to-a-hack-justin-sun-says","credibility":2,"archive_timestamp":"2026-07-27T13:54:15+00:00"},{"url":"https://www.halborn.com/blog/post/explained-the-huobi-exchange-hack-september-2023","name":"Halborn — Explained: The Huobi Exchange Hack (September 2023)","type":"research","archive_url":"http://web.archive.org/web/20260415070412/https://www.halborn.com/blog/post/explained-the-huobi-exchange-hack-september-2023","credibility":2,"archive_timestamp":"2026-04-15T07:04:12+00:00"},{"url":"https://decrypt.co/205465/justin-sun-owned-crypto-exchange-poloniex-hacked-60m","name":"Decrypt — Justin Sun-Owned Exchange Poloniex Hacked for At Least $126 Million","type":"news_article","archive_url":"http://web.archive.org/web/20260719162226/https://decrypt.co/205465/justin-sun-owned-crypto-exchange-poloniex-hacked-60m","credibility":2,"archive_timestamp":"2026-07-19T16:22:26+00:00"},{"url":"https://www.sec.gov/newsroom/press-releases/2023-59","name":"SEC.gov — SEC Charges Crypto Entrepreneur Justin Sun and His Companies for Fraud","type":"regulatory","archive_url":"http://web.archive.org/web/20260716165323/https://www.sec.gov/newsroom/press-releases/2023-59","credibility":1,"archive_timestamp":"2026-07-16T16:53:23+00:00"},{"url":"https://blockonomi.com/heco-chain-announces-january-2025-closure-users-urged-to-redeem-assets/","name":"Blockonomi — HECO Chain Announces January 2025 Closure","type":"news_article","archive_url":"https://web.archive.org/web/20260726134733/https://blockonomi.com/pepetos-600k-presale-highlights-vision-for-supporting-memecoins-ahead-of-2025/","credibility":2,"archive_timestamp":"2026-07-26T13:47:33+00:00"},{"url":"https://olympixai.medium.com/heco-bridge-hack-analysis-64cffda76684","name":"Olympix — Heco Bridge Hack Analysis","type":"research","archive_url":"http://web.archive.org/web/20260203031954/https://olympixai.medium.com/heco-bridge-hack-analysis-64cffda76684","credibility":2,"archive_timestamp":"2026-02-03T03:19:54+00:00"},{"url":"https://www.scmp.com/tech/big-tech/article/3242535/crypto-exchange-htx-suffers-us30-million-hack-after-another-platform-linked-entrepreneur-justin-sun","name":"South China Morning Post — Crypto exchange HTX suffers US$30 million hack","type":"news_article","archive_url":"http://web.archive.org/web/20260725163707/https://www.scmp.com/tech/big-tech/article/3242535/crypto-exchange-htx-suffers-us30-million-hack-after-another-platform-linked-entrepreneur-justin-sun","credibility":2,"archive_timestamp":"2026-07-25T16:37:07+00:00"},{"url":"https://ng.investing.com/news/stock-market-news/justin-sun-pledges-to-reimburse-htx-users-after-866-million-heco-chain-exploit-93CH-1150520","name":"Investing.com — Justin Sun pledges to reimburse HTX users after $86.6 million HECO Chain exploit","type":"news_article","archive_url":null,"credibility":2,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://www.prnewswire.com/news-releases/huobi-announces-early-access-to-huobi-eco-chain-an-ethereum-compatible-public-chain-for-blockchain-developers-301190736.html","name":"PR Newswire — Huobi Announces Early Access to Huobi Eco Chain","type":"official","archive_url":"https://web.archive.org/web/20260830010037/https://www.prnewswire.com/news-releases/huobi-announces-early-access-to-huobi-eco-chain-an-ethereum-compatible-public-chain-for-blockchain-developers-301190736.html","credibility":3,"archive_timestamp":"2026-08-30T01:00:37+00:00"},{"url":"https://pontem.network/posts/a-deep-dive-into-the-heco-chain","name":"Pontem Network — A Deep Dive into the HECO Chain","type":"research","archive_url":"http://web.archive.org/web/20260612103911/https://pontem.network/posts/a-deep-dive-into-the-heco-chain","credibility":3,"archive_timestamp":"2026-06-12T10:39:11+00:00"},{"url":"https://coinmarketcap.com/academy/article/52cb9dfd-1370-47cc-a30e-dc3a67bbcd9a","name":"CoinMarketCap Academy — HECO Chain article","type":"research","archive_url":null,"credibility":3,"archive_error":"error:not-found","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://rekt.news/heco-htx-rekt","name":"Rekt News — Heco / HTX","type":"research","archive_url":"http://web.archive.org/web/20260518002950/https://rekt.news/heco-htx-rekt","credibility":3,"archive_timestamp":"2026-05-18T00:29:50+00:00"},{"url":"https://cointelegraph.com/news/justin-sun-platforms-hacked-4-times","name":"CoinTelegraph — Justin Sun platforms hacked four times","type":"news_article","archive_url":"http://web.archive.org/web/20260318124534/https://cointelegraph.com/news/justin-sun-platforms-hacked-4-times","credibility":3,"archive_timestamp":"2026-03-18T12:45:34+00:00"},{"url":"https://coinpaper.com/2725/another-justin-sun-s-project-is-hacked-over-113-million-lost","name":"Coinpaper — Another Justin Sun project is hacked, over $113 million lost","type":"news_article","archive_url":"http://web.archive.org/web/20260612211731/https://coinpaper.com/2725/another-justin-sun-s-project-is-hacked-over-113-million-lost","credibility":3,"archive_timestamp":"2026-06-12T21:17:31+00:00"},{"url":"https://www.cnbc.com/2023/11/23/htx-heco-chain-crypto-hack-115-million-stolen-so-far.html","name":"CNBC — HTX, Heco Chain crypto hack: $115 million stolen so far","type":"news_article","archive_url":"http://web.archive.org/web/20260522060819/https://www.cnbc.com/2023/11/23/htx-heco-chain-crypto-hack-115-million-stolen-so-far.html","credibility":3,"archive_timestamp":"2026-05-22T06:08:19+00:00"},{"url":"https://crypto.news/heco-bridge-tornado-cash-hack/","name":"Crypto.news — Heco Bridge Tornado Cash","type":"news_article","archive_url":"http://web.archive.org/web/20251008061430/https://crypto.news/heco-bridge-tornado-cash-hack/","credibility":3,"archive_timestamp":"2025-10-08T06:14:30+00:00"},{"url":"https://www.investing.com/news/cryptocurrency-news/justin-sun-pledges-to-reimburse-htx-users-after-866-million-heco-chain-exploit-93CH-3241877","name":"Investing.com — Justin Sun pledges to reimburse HTX users after $86.6 million HECO Chain exploit","type":"news_article","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://www.bankinfosecurity.com/cryptohack-roundup-87-million-heco-hack-a-23679","name":"BankInfoSecurity — Cryptohack Roundup: Heco Loses $87 Million to Hack Attack","type":"news_article","archive_url":"http://web.archive.org/web/20261014013618/https://www.bankinfosecurity.com/cryptohack-roundup-87-million-heco-hack-a-23679","credibility":2,"archive_timestamp":"2026-10-14T01:36:18+00:00"},{"url":"https://dapp.expert/news/en_heco-to-officially-shutdown-in-january-2025-key-information-for-users","name":"Dapp.expert — HECO to Officially Shutdown in January 2025","type":"news_article","archive_url":"https://web.archive.org/web/20261014025239/https://dapp.expert/news/en_heco-to-officially-shutdown-in-january-2025-key-information-for-users","credibility":3,"archive_timestamp":"2026-10-14T02:52:39+00:00"},{"url":"https://www.coindesk.com/policy/2023/03/22/tron-founder-justin-sun-sued-by-us-sec-on-securities-market-manipulation-charges","name":"CoinDesk — Tron Founder Justin Sun Sued by U.S. SEC","type":"news_article","archive_url":"http://web.archive.org/web/20261004234437/https://www.coindesk.com/policy/2023/03/22/tron-founder-justin-sun-sued-by-us-sec-on-securities-market-manipulation-charges","credibility":1,"archive_timestamp":"2026-10-04T23:44:37+00:00"},{"url":"https://thedefiant.io/news/regulation/sec-and-justin-sun-pause-tron-fraud-lawsuit-for-settlement-talks","name":"The Defiant — SEC and Justin Sun Pause Tron Fraud Lawsuit for Settlement Talks","type":"news_article","archive_url":"http://web.archive.org/web/20261010134349/https://thedefiant.io/news/regulation/sec-and-justin-sun-pause-tron-fraud-lawsuit-for-settlement-talks","credibility":2,"archive_timestamp":"2026-10-10T13:43:49+00:00"},{"url":"https://www.bitcoininsider.org/article/228781/htx-huobi-hacker-returns-8-million-stolen-crypto-and-leaves-message-behind","name":"Bitcoin Insider — HTX/Huobi hacker returns $8 million stolen crypto","type":"news_article","archive_url":"http://web.archive.org/web/20261010135003/https://www.bitcoininsider.org/article/228781/htx-huobi-hacker-returns-8-million-stolen-crypto-and-leaves-message-behind","credibility":2,"archive_timestamp":"2026-10-10T13:50:03+00:00"},{"url":"https://cointelegraph.com/news/htx-huobi-bitcoin-withdrawal-deposit-back-after-hot-wallet-hack","name":"CoinTelegraph — HTX deposits and withdrawals back after hot wallet hack","type":"news_article","archive_url":"http://web.archive.org/web/20261010135129/https://cointelegraph.com/news/htx-huobi-bitcoin-withdrawal-deposit-back-after-hot-wallet-hack","credibility":2,"archive_timestamp":"2026-10-10T13:51:29+00:00"}],"source_tags":[],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-code-merge-writer","created_at":"2026-06-01T17:48:02.630073+00:00","updated_at":"2026-10-14T02:54:14.286507+00:00"},"source_quality":{"total":34,"tier1":1,"tier2":15,"tier3":0,"unrated":18},"follower_count":null,"content_updated_at":"2026-10-14T00:23:03.224Z","last_fact_checked_at":"2026-06-04T20:53:33.966Z","fact_check_next_allowed_at":null,"update_next_allowed_at":null}