{"investigation":{"slug":"kronos-research","entity_name":"Kronos Research","trust_score":28,"severity_base":null,"score_modifier":0,"confidence":1,"status":"published","content_type":"investigation","summary":"Kronos Research is a Taipei-based cryptocurrency quantitative trading firm and market maker founded in 2018 by Mark Pimentel and Jack Tan. The firm experienced two serious security incidents within months of each other in 2023: an insider sabotage case in which two disgruntled engineers tampered with trading code causing $1.4 million in losses, and an external hack in November 2023 where compromised API keys led to the theft of approximately $25–26 million. The November hack cascaded onto WOO X, an exchange Kronos incubated and served as primary liquidity provider, causing a temporary trading halt and liquidations for 227 users.","sections":[{"content":"Kronos Research is a quantitative trading firm and cryptocurrency market maker headquartered in Taipei, Taiwan, founded in June 2018 by Mark Pimentel and Jack Tan, who met at Carnegie Mellon University. Pimentel previously worked in high-frequency trading at Citadel and Knight Capital; Tan held roles at BNP Paribas, Citi, and Deutsche Bank. The firm focuses on high-frequency trading, market making, arbitrage, and asset management across more than 50 exchanges globally. It reportedly operates over 300 trading servers and has claimed an average daily trading volume of $5 billion, with a peak single-day volume of $23 billion. Kronos also incubated WOO Network (later WOO X) in 2019 and served as its primary backstop liquidity provider. The firm employs approximately 110 people worldwide. CEO Hank Huang joined as CTO in 2019 and led significant system and team growth.","heading":"Background","sources":[{"url":"https://medium.com/@C137K/from-taiwan-to-the-world-stage-kronos-research-and-their-ascension-in-crypto-market-making-d92e08941d78","name":"","type":"other","credibility":3},{"url":"https://www.kronosresearch.com/","name":"","type":"other","credibility":3},{"url":"https://iq.wiki/wiki/mark-pimentel","name":"","type":"other","credibility":3},{"url":"https://iq.wiki/wiki/jack-tan","name":"","type":"other","credibility":3}],"severity":"medium"},{"content":"On November 19, 2023, Kronos Research disclosed via X (formerly Twitter) that an unauthorized party had gained access to several of the firm's exchange API keys. Blockchain investigator ZachXBT identified approximately $25–26 million drained across six transactions into distinct attacker-controlled wallets. The stolen assets consisted primarily of approximately 2,780 ETH, 2,540 ETH, 2,540 ETH, 2,636 ETH, 4.93 ETH, and 2,507.52 ETH across multiple transfers, plus stablecoins including roughly 24.57 million USDT and 125,056 USDC. Funds were routed from accounts on OKX, BTSE, Binance, and Deeocoin. On exchanges where whitelist restrictions applied, funds were first routed through Kronos's own address before reaching the attacker's wallet at 0x2b0502FDab4e221dcD492c058255D2073d50A3ae. Kronos halted all trading upon discovery and stated that losses would be covered internally with no partners affected. On November 28, 2023, Kronos publicly offered the hacker a 10% bounty — the right to retain approximately $2.5 million — in exchange for returning 90% of the stolen funds, threatening legal action if the deadline of November 30, 2023 08:00 UTC was not met. No return was made. Starting approximately six months later, the attacker began laundering funds through Tornado Cash, moving at least $4 million in batches of 100 ETH across 10 transactions. The root cause of the API key compromise was not publicly confirmed, though phishing is a common vector for such credential theft.","heading":"The $25M API Key Hack","sources":[{"url":"https://cointelegraph.com/news/kronos-research-halts-trading-25-m-hack-investigation","name":"","type":"other","credibility":3},{"url":"https://www.halborn.com/blog/post/explained-the-kronos-research-hack-november-2023","name":"","type":"other","credibility":3},{"url":"https://www.coindesk.com/markets/2023/11/28/crypto-trading-firm-kronos-research-offers-10-bounty-to-hacker","name":"","type":"other","credibility":3},{"url":"https://rekt.news/kronos-rekt","name":"","type":"other","credibility":3},{"url":"https://cointelegraph.com/news/kronos-research-hacker-funds-tornado-cash-exploit","name":"","type":"other","credibility":3},{"url":"https://cryptonews.com/news/kronos-research-hacker-launders-4m-through-tornado-cash/","name":"","type":"other","credibility":3}],"severity":"medium"},{"content":"In a separate incident reported in August 2023, two former engineers at Kronos Research allegedly sabotaged the firm's trading systems prior to their departure. According to reporting by Cryptonews.net and Blockchain.news, the engineers were dissatisfied with unpaid bonuses owed to them and deliberately manipulated Kronos's algorithmic trading code — specifically, code used for simulating trading environments and predictive analysis. The tampering caused the program to mistake the worst parameter combination for the best, leading to systematically poor investment decisions. The firm sustained alleged losses of approximately $1.4 million (reported as approximately 42 million New Taiwan Dollars). Both engineers were tried in a Taipei court and sentenced to fixed-term imprisonment, with the option to pay a fine in lieu of incarceration. The incident predated the November 2023 API key hack and highlighted vulnerabilities in Kronos Research's internal access controls and personnel security practices. No further regulatory actions or criminal proceedings beyond the Taipei court sentencing were identified in available sources.","heading":"Insider Incident","sources":[{"url":"https://cryptonews.net/news/legal/21491729/","name":"","type":"other","credibility":3},{"url":"https://blockchain.news/news/quant-firm-kronos-Research-loses-14m-code-tampered-by-disgruntled-engineers","name":"","type":"other","credibility":3},{"url":"https://rekt.news/kronos-rekt","name":"","type":"other","credibility":3}],"severity":"medium"},{"content":"Kronos Research incubated WOO Network (the parent entity of the WOO X trading platform) in 2019, and has served as WOO X's primary backstop liquidity provider since the platform's inception. Originally conceived as a liquidity conduit for exchanges to tap Kronos's market-making reserves, the relationship made Kronos WOO X's single largest liquidity source for both spot and perpetual futures markets. When Kronos halted trading on November 18–19, 2023 following the API key hack, WOO X experienced a severe liquidity shortage and paused all markets at approximately 21:00 UTC on November 18. The exchange remained fully offline for approximately two hours, with perpetual futures markets reopening by 23:30 UTC, all 134 perpetual markets by Sunday 00:30 UTC, withdrawals restored by 04:30 UTC, and spot trading resuming by 08:00 UTC — a total restoration window of approximately 11 hours. During the liquidity disruption, 227 WOO X users experienced partial or full liquidations. The exchange subsequently compensated all affected users and processed approximately $13 million in net withdrawals over a 48-hour period without losses. WOO X had already begun reducing its dependence on Kronos Research as its sole liquidity provider following the FTX collapse in late 2022, restructuring its fee model in July 2023 and onboarding additional Designated Market Makers in August 2023. Observers and commentators, including rekt.news, drew comparisons between the Kronos-WOO X interdependence and the Alameda Research-FTX relationship, noting that the close financial ties between an exchange and a single dominant market maker create systemic concentration risk for exchange users.","heading":"WOO X Connection","sources":[{"url":"https://woox.io/blog/transparency-update-liquidity-incident-review","name":"","type":"other","credibility":3},{"url":"https://woo.org/blog/en/transparency-update-liquidity-incident-review","name":"","type":"other","credibility":3},{"url":"https://rekt.news/kronos-rekt","name":"","type":"other","credibility":3},{"url":"https://www.theblock.co/post/273294/woo-x-fundraise-improve-liquidity","name":"","type":"other","credibility":3}],"severity":"medium"},{"content":"Kronos Research presents a mixed risk profile. On one hand, it is an operationally active, institutionally credentialed market maker with significant trading volume claims, co-founders with verifiable traditional finance and HFT backgrounds, and a stated policy of absorbing losses internally without passing them to counterparties. On the other hand, the firm experienced two serious security failures within a single year: an insider sabotage incident in mid-2023 and a large-scale external hack in November 2023 totaling over $26 million in losses. The November 2023 hack resulted in stolen funds being laundered through Tornado Cash, with no confirmed recovery. The firm's close structural relationship with WOO X — acting as sole or dominant liquidity provider for a customer-facing exchange — created contagion risk that materialized directly when the hack occurred and caused user liquidations. The stolen API keys were never publicly attributed to a specific attack vector, and the firm's internal investigation findings were not made public. The insider incident, while resulting in a Taipei court conviction, raises questions about internal access control maturity and personnel security practices at the firm. The trust score of 28 reflects verified, documented losses, a failure to recover stolen funds, a laundering event, and systemic counterparty risk demonstrated in practice, partially offset by the firm's apparent financial resilience, institutional background of founders, and transparent post-incident communications.","heading":"Risk Assessment","sources":[{"url":"https://cointelegraph.com/news/kronos-research-halts-trading-25-m-hack-investigation","name":"","type":"other","credibility":3},{"url":"https://cryptonews.net/news/legal/21491729/","name":"","type":"other","credibility":3},{"url":"https://woox.io/blog/transparency-update-liquidity-incident-review","name":"","type":"other","credibility":3},{"url":"https://cointelegraph.com/news/kronos-research-hacker-funds-tornado-cash-exploit","name":"","type":"other","credibility":3}],"severity":"medium"}],"timeline":[{"date":"2018-06","event":"Kronos Research founded in Taipei, Taiwan by Mark Pimentel and Jack Tan.","source":"","date_original":"2018-06-01"},{"date":"2019","event":"Kronos Research incubates WOO Network (later WOO X) and becomes its primary backstop liquidity provider.","source":"","date_original":"2019-01-01"},{"date":"2023-08-27","event":"Two disgruntled former engineers convicted in Taipei court for tampering with Kronos Research trading algorithms over unpaid bonuses, causing $1.4 million in losses.","source":""},{"date":"2023-11-18","event":"Unauthorized party accesses Kronos Research exchange API keys and begins draining approximately $25–26 million across multiple exchanges. WOO X halts all trading at approximately 21:00 UTC due to liquidity shortage.","source":""},{"date":"2023-11-19","event":"Kronos Research publicly discloses the API key hack via X. Firm states losses will be covered internally with no partners affected. WOO X fully restores operations within approximately 11 hours.","source":""},{"date":"2023-11-21","event":"WOO X publishes transparency report detailing 227 user liquidations during the liquidity gap and confirms full user compensation.","source":""},{"date":"2023-11-28","event":"Kronos Research publicly offers hacker a 10% bounty (approximately $2.5 million) to return 90% of stolen funds, with a deadline of November 30, 2023 08:00 UTC and threat of legal action.","source":""},{"date":"2023-11-30","event":"Kronos Research bounty deadline passes with no return of funds reported.","source":""},{"date":"2024-05","event":"Hacker begins laundering stolen funds through Tornado Cash, moving approximately $4 million in 10 batches of 100 ETH.","source":"","date_original":"2024-05-01"}],"sources_used":[{"url":"https://medium.com/@C137K/from-taiwan-to-the-world-stage-kronos-research-and-their-ascension-in-crypto-market-making-d92e08941d78","name":"","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://www.kronosresearch.com/","name":"","type":"other","archive_url":"http://web.archive.org/web/20260606065957/https://www.kronosresearch.com/","credibility":3,"archive_timestamp":"2026-06-06T06:59:57+00:00"},{"url":"https://iq.wiki/wiki/mark-pimentel","name":"","type":"other","archive_url":"http://web.archive.org/web/20260517155304/https://iq.wiki/wiki/mark-pimentel","credibility":3,"archive_timestamp":"2026-05-17T15:53:04+00:00"},{"url":"https://iq.wiki/wiki/jack-tan","name":"","type":"other","archive_url":"http://web.archive.org/web/20260312164204/https://iq.wiki/wiki/jack-tan","credibility":3,"archive_timestamp":"2026-03-12T16:42:04+00:00"},{"url":"https://cointelegraph.com/news/kronos-research-halts-trading-25-m-hack-investigation","name":"","type":"other","archive_url":"https://web.archive.org/web/20260829113642/https://cointelegraph.com/news/kronos-research-halts-trading-25-m-hack-investigation","credibility":3,"archive_timestamp":"2026-08-29T11:36:42+00:00"},{"url":"https://www.halborn.com/blog/post/explained-the-kronos-research-hack-november-2023","name":"","type":"other","archive_url":"http://web.archive.org/web/20260605231802/https://www.halborn.com/blog/post/explained-the-kronos-research-hack-november-2023","credibility":3,"archive_timestamp":"2026-06-05T23:18:02+00:00"},{"url":"https://www.coindesk.com/markets/2023/11/28/crypto-trading-firm-kronos-research-offers-10-bounty-to-hacker","name":"","type":"other","archive_url":"http://web.archive.org/web/20250905212710/https://www.coindesk.com/markets/2023/11/28/crypto-trading-firm-kronos-research-offers-10-bounty-to-hacker","credibility":3,"archive_timestamp":"2025-09-05T21:27:10+00:00"},{"url":"https://rekt.news/kronos-rekt","name":"","type":"other","archive_url":"http://web.archive.org/web/20260415154806/https://rekt.news/kronos-rekt","credibility":3,"archive_timestamp":"2026-04-15T15:48:06+00:00"},{"url":"https://cointelegraph.com/news/kronos-research-hacker-funds-tornado-cash-exploit","name":"","type":"other","archive_url":"https://web.archive.org/web/20260829130826/https://cointelegraph.com/news/kronos-research-hacker-funds-tornado-cash-exploit","credibility":3,"archive_timestamp":"2026-08-29T13:08:26+00:00"},{"url":"https://cryptonews.com/news/kronos-research-hacker-launders-4m-through-tornado-cash/","name":"","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://cryptonews.net/news/legal/21491729/","name":"","type":"other","archive_url":"https://web.archive.org/web/20260829113848/https://cryptonews.net/news/legal/21491729/","credibility":3,"archive_timestamp":"2026-08-29T11:38:48+00:00"},{"url":"https://blockchain.news/news/quant-firm-kronos-Research-loses-14m-code-tampered-by-disgruntled-engineers","name":"","type":"other","archive_url":"http://web.archive.org/web/20260118101508/https://blockchain.news/news/quant-firm-kronos-Research-loses-14m-code-tampered-by-disgruntled-engineers","credibility":3,"archive_timestamp":"2026-01-18T10:15:08+00:00"},{"url":"https://woox.io/blog/transparency-update-liquidity-incident-review","name":"","type":"other","archive_url":"http://web.archive.org/web/20260314200835/https://woox.io/blog/transparency-update-liquidity-incident-review","credibility":3,"archive_timestamp":"2026-03-14T20:08:35+00:00"},{"url":"https://woo.org/blog/en/transparency-update-liquidity-incident-review","name":"","type":"other","archive_url":"https://web.archive.org/web/20260829143412/https://woox.io/en/blog/transparency-update-liquidity-incident-review","credibility":3,"archive_timestamp":"2026-08-29T14:34:12+00:00"},{"url":"https://www.theblock.co/post/273294/woo-x-fundraise-improve-liquidity","name":"","type":"other","archive_url":null,"credibility":3,"archive_timestamp":null}],"source_tags":["defillama"],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-sonnet-4-6","created_at":"2026-05-04T02:54:37.006951+00:00","updated_at":"2026-08-30T05:14:09.150894+00:00"}}