{"investigation":{"slug":"m2-exchange","entity_name":"M2 Exchange","trust_score":51,"severity_base":51,"score_modifier":0,"confidence":1,"status":"published","content_type":"investigation","summary":"M2 Exchange is an Abu Dhabi-based centralized cryptocurrency exchange licensed by the ADGM FSRA that suffered a $13.7 million hot wallet breach on October 31, 2024, attributed to an access control vulnerability spanning Bitcoin, Ethereum, and Solana. The exchange says it covered all customer losses from company reserves, though the lack of a public post-mortem, proof of reserves or independent verification, and leadership turnover raise unresolved transparency questions.","sections":[{"content":"M2 Exchange (operating at m2.com) launched in October 2023 as a centralized crypto trading and custody platform headquartered in Abu Dhabi, United Arab Emirates. The platform targets both retail and institutional clients across more than 150 countries, excluding the United States. Co-founders include Bijan Alizadeh-Fard, who also co-founded Abu Dhabi-based venture firms Phoenix Group and Cypher Capital, and Stefan Kimmel, formerly of Kraken (described in one page as Kraken MENA) and the Commercial Bank of Dubai. The exchange offers spot trading, perpetual futures, earn products, staking, margin trading, an OTC desk, crypto loans, AED fiat on/off-ramp services and institutional custody (including offline cold storage) across more than 50 listed assets. Its native utility token is MMX, which has a fixed supply of 500 million tokens and was audited by CertiK. M2 operates through two ADGM-registered entities: M2 Limited (registration 220090) and M2 Custody Limited (registration 220130). Custody infrastructure is integrated with Fireblocks, an institutional MPC custody provider.","heading":"Background","sources":[{"url":"https://beincrypto.com/learn/m2-review/","name":"beincrypto.com","type":"other","credibility":3},{"url":"https://www.adgm.com/media/announcements/virtual-assets-trading-platform-m2-receives-financial-services-permission-from-adgm","name":"adgm.com","type":"other","credibility":3},{"url":"https://skynet.certik.com/projects/m2-exchange","name":"skynet.certik.com","type":"other","credibility":3},{"url":"https://www.fintechfutures.com/job-cuts-new-hires/crypto-platform-m2-reshuffles-leadership-with-ex-bitstamp-exec-james-greenwood-named-ceo","name":"fintechfutures.com","type":"other","credibility":3}],"severity":"medium"},{"content":"One page reports two CEO transitions within the platform's first eighteen months: Stefan Kimmel moved to the board in late 2024 (October 2024 per the timeline), succeeded by Saadeddine Zaher, who was in turn succeeded by James Greenwood, formerly Chief Technology and Operations Officer at Bitstamp (named CEO in 2025). A second page describes Kimmel as early CEO with Greenwood subsequently taking the role alongside Bill Qian as Managing Director, and does not mention Zaher. Leadership churn of this kind may affect operational continuity.","heading":"Leadership changes","sources":[{"url":"https://www.fintechfutures.com/job-cuts-new-hires/crypto-platform-m2-reshuffles-leadership-with-ex-bitstamp-exec-james-greenwood-named-ceo","name":"fintechfutures.com","type":"other","credibility":3},{"url":"https://beincrypto.com/learn/m2-review/","name":"beincrypto.com","type":"other","credibility":3}],"severity":"low"},{"content":"On October 31, 2024, at approximately 3:16 AM local time (GMT+4), an attacker drained approximately $13.7 million from M2's hot wallets across Bitcoin, Ethereum, and Solana. The incident was first detected and publicly reported by blockchain security firm Cyvers and on-chain investigator ZachXBT. The stolen assets comprised roughly $3.7 million in USDT, 97 million SHIB tokens, and 1,378 ETH. On-chain analysts identified the primary Ethereum hot wallet as 0xE26abc37b06B819243B4B104270Cc18f7C835FcE; funds were routed to an intermediate externally owned account (0xb5f798096bd4D969466E2284Bda01F7A51049d3A) and then consolidated at 0x968b6984cba14444f23ee51be90652408155e142. Implicated Bitcoin and Solana addresses were bc1qu4kh7wa38xpkrp8frgxl4sak88wx0jug8n3vfj and EKko14NvgqdvNttUb8JjXkVGuUs6BTikjfN3hqW4LQoL. The attacker swapped SHIB and USDT into ETH on Ethereum, a common obfuscation step, and as of November 4, 2024, approximately $10 million in ETH remained unmixed and stationary in the attacker's wallets. As of mid-2025 no arrests or attribution had been publicly reported.","heading":"October 2024 hot wallet breach","sources":[{"url":"https://cryptoslate.com/uaes-m2-crypto-exchange-hacked-for-13-7m-assures-full-fund-recovery/","name":"cryptoslate.com","type":"other","credibility":3},{"url":"https://www.quillaudits.com/blog/hack-analysis/m2-crypto-exchange-exploit","name":"quillaudits.com","type":"other","credibility":3},{"url":"https://www.web3isgoinggreat.com/single/m2-hack","name":"web3isgoinggreat.com","type":"other","credibility":3},{"url":"https://protos.com/crypto-exchange-m2-reimburses-victims-after-14m-halloween-hack/","name":"protos.com","type":"other","credibility":3},{"url":"https://www.cryptopolitan.com/m2-exchange-reports-hack-restores-13-7m-in-eth-sol-and-btc/","name":"cryptopolitan.com","type":"other","credibility":3},{"url":"https://www.fxleaders.com/news/2024/11/02/crypto-exchange-m2-recovers-13-7-million-after-breach-resolved-in-16-minutes/","name":"fxleaders.com","type":"other","credibility":3}],"severity":"high"},{"content":"Security researchers attributed the breach to an access control vulnerability in M2's hot wallet infrastructure that allegedly let an attacker bypass authorization checks and initiate withdrawals without triggering multi-factor authentication (MFA) or multi-signature approval. QuillAudits noted that the absence of MFA and multi-sig controls on the hot wallets were contributing factors, and Cyvers flagged the incident as consistent with that absence. The attacker's first transaction moved funds from the hot wallet to an externally owned account, from which funds were distributed across multiple addresses before consolidation. M2 described the event only as a 'cybersecurity incident' and did not publicly disclose a precise root cause. M2 stated it detected the breach and remediated the vulnerability within 16 minutes (by 3:32 AM); that claim has not been independently verified and drew skepticism from parts of the security community, and the fact that about $10 million in ETH remained in the attacker's wallets suggests the breach was contained by isolating infrastructure rather than by recovering assets. No post-mortem was published by M2, no independent audit of the remediation was released, and M2 has not disclosed which access controls were added.","heading":"Access control vulnerability and M2's response","sources":[{"url":"https://www.quillaudits.com/blog/hack-analysis/m2-crypto-exchange-exploit","name":"quillaudits.com","type":"other","credibility":3},{"url":"https://cryptoslate.com/uaes-m2-crypto-exchange-hacked-for-13-7m-assures-full-fund-recovery/","name":"cryptoslate.com","type":"other","credibility":3},{"url":"https://www.fxleaders.com/news/2024/11/02/crypto-exchange-m2-recovers-13-7-million-after-breach-resolved-in-16-minutes/","name":"fxleaders.com","type":"other","credibility":3},{"url":"https://www.ccn.com/news/crypto/crypto-exchange-m2-security-breach/","name":"ccn.com","type":"other","credibility":3},{"url":"https://protos.com/crypto-exchange-m2-reimburses-victims-after-14m-halloween-hack/","name":"protos.com","type":"other","credibility":3}],"severity":"high"},{"content":"M2's official acknowledgment on November 1, 2024 confirmed the breach, stated that all affected customer funds had been fully restored from company reserves rather than by recovering the stolen assets, said it had implemented enhanced security controls, and said it had contacted police and relevant legal authorities and was cooperating with UAE legal and regulatory authorities. M2 states that client funds are segregated from operational assets and that digital assets are held predominantly in cold storage via Fireblocks-integrated MPC custody; it claims to conduct external security audits. M2 has not published a proof-of-reserves report, no independent verification of its solvency or completeness of customer coverage is publicly available, and no publicly disclosed insurance covers customer assets. No formal deposit protection scheme analogous to FDIC or FSCS applies to crypto held on M2. Customer support is limited to non-telephone channels.","heading":"Reimbursement and customer protection","sources":[{"url":"https://protos.com/crypto-exchange-m2-reimburses-victims-after-14m-halloween-hack/","name":"protos.com","type":"other","credibility":3},{"url":"https://cryptoslate.com/uaes-m2-crypto-exchange-hacked-for-13-7m-assures-full-fund-recovery/","name":"cryptoslate.com","type":"other","credibility":3},{"url":"https://www.cryptopolitan.com/m2-exchange-reports-hack-restores-13-7m-in-eth-sol-and-btc/","name":"cryptopolitan.com","type":"other","credibility":3},{"url":"https://www.fxleaders.com/news/2024/11/02/crypto-exchange-m2-recovers-13-7-million-after-breach-resolved-in-16-minutes/","name":"fxleaders.com","type":"other","credibility":3},{"url":"https://beincrypto.com/learn/m2-review/","name":"beincrypto.com","type":"other","credibility":3},{"url":"https://www.ccn.com/news/crypto/crypto-exchange-m2-security-breach/","name":"ccn.com","type":"other","credibility":3},{"url":"https://www.quillaudits.com/blog/hack-analysis/m2-crypto-exchange-exploit","name":"quillaudits.com","type":"other","credibility":3},{"url":"https://skynet.certik.com/projects/m2-exchange","name":"skynet.certik.com","type":"other","credibility":3}],"severity":"medium"},{"content":"M2 operates under a Financial Services Permission (FSP) from the Financial Services Regulatory Authority (FSRA) of the Abu Dhabi Global Market (ADGM) authorizing a multilateral trading facility (MTF) and virtual asset custody for retail and institutional clients in the UAE. Sources differ on the date: August 16, 2023 for the FSP on one page, November 28, 2023 for the licence on another. ADGM/FSRA is distinct from Dubai's VARA; M2 holds no known VARA license. The FSRA framework, considered one of the more rigorous virtual asset regimes in the MENA region, requires client asset segregation and technology governance, market surveillance and consumer protection standards. M2 Limited and M2 Custody Limited provide structural separation between trading and custody. The October 2024 hack occurred roughly a year after licensing, raising questions about hot wallet security relative to its regulated status. No public statement from the FSRA or any other regulator regarding the incident, and no enforcement action, has been identified. M2 is not registered or licensed in the United States and excludes US persons.","heading":"Regulatory status","sources":[{"url":"https://www.adgm.com/media/announcements/virtual-assets-trading-platform-m2-receives-financial-services-permission-from-adgm","name":"adgm.com","type":"other","credibility":3},{"url":"https://www.adgm.com/media/announcements/m2-secures-adgm-licence-and-plans-rollout-of-fully-regulated-crypto-services-to-uae","name":"adgm.com","type":"other","credibility":3},{"url":"https://www.thenationalnews.com/business/money/2023/10/11/adgm-licensed-m2-crypto-platform-rolls-out-services-for-investors/","name":"thenationalnews.com","type":"other","credibility":3}],"severity":"medium"},{"content":"M2 presents an elevated risk profile relative to major global exchanges, mainly due to the confirmed hot wallet breach and the unresolved transparency gaps that followed: (1) a hot wallet security failure attributed to absent MFA and inadequate access controls, with no public post-mortem; (2) no public proof of reserves or independent solvency verification; (3) no disclosed insurance fund; (4) leadership turnover within about eighteen months of launch; (5) stolen funds largely unrecovered and the attacker unidentified. Mitigating factors are the active ADGM/FSRA licence, the segregation policy, Fireblocks MPC custody, and the decision to cover all customer losses from company reserves. The exchange appears to be a legitimate, licensed entity, not a scam or exit-fraud operation, but the combination warrants caution for users holding significant balances.","heading":"Risk assessment","sources":[{"url":"https://www.quillaudits.com/blog/hack-analysis/m2-crypto-exchange-exploit","name":"quillaudits.com","type":"other","credibility":3},{"url":"https://cryptoslate.com/uaes-m2-crypto-exchange-hacked-for-13-7m-assures-full-fund-recovery/","name":"cryptoslate.com","type":"other","credibility":3},{"url":"https://www.adgm.com/media/announcements/virtual-assets-trading-platform-m2-receives-financial-services-permission-from-adgm","name":"adgm.com","type":"other","credibility":3},{"url":"https://www.fxleaders.com/news/2024/11/02/crypto-exchange-m2-recovers-13-7-million-after-breach-resolved-in-16-minutes/","name":"fxleaders.com","type":"other","credibility":3}],"severity":"medium"}],"timeline":[{"date":"2023-08","event":"ADGM FSRA grants M2 Limited and M2 Custody Limited Financial Services Permission to operate an MTF and custody service in Abu Dhabi.","source":""},{"date":"2023-10","event":"M2 Exchange publicly launches retail and institutional services, initially offering BTC and ETH trading with AED fiat pairs.","source":""},{"date":"2023-11","event":"M2 receives ADGM license from the FSRA, recognized as a regulated Multilateral Trading Facility and custodian.","source":"adgm.com","source_url":"https://www.adgm.com/media/announcements/m2-secures-adgm-licence-and-plans-rollout-of-fully-regulated-crypto-services-to-uae"},{"date":"2024-10","event":"Stefan Kimmel steps down as CEO and moves to the M2 Board of Directors; Saadeddine Zaher appointed CEO.","source":""},{"date":"2024-10","event":"Attacker exploits hot wallet access control vulnerability at approximately 3:16 AM (GMT+4), draining ~$13.7M across Bitcoin, Ethereum, and Solana. ZachXBT and Cyvers publicly identify suspicious transactions.","source":"cryptoslate.com","source_url":"https://cryptoslate.com/uaes-m2-crypto-exchange-hacked-for-13-7m-assures-full-fund-recovery/"},{"date":"2024-10","event":"M2 states it detected the breach and responded within 16 minutes (by 3:32 AM); exchange covers all customer losses from company reserves and states services are restored.","source":"fxleaders.com","source_url":"https://www.fxleaders.com/news/2024/11/02/crypto-exchange-m2-recovers-13-7-million-after-breach-resolved-in-16-minutes/"},{"date":"2024-11","event":"M2 officially announces the breach resolved and all affected customer funds fully restored from reserves (announcement dated 1 November 2024), states cooperation with UAE legal and regulatory authorities, enhanced security controls and engagement of law enforcement.","source":"protos.com","source_url":"https://protos.com/crypto-exchange-m2-reimburses-victims-after-14m-halloween-hack/"},{"date":"2024-11","event":"On-chain analysts confirm approximately $10 million in ETH remains unmixed in the attacker's consolidation wallet; no attacker identified.","source":""},{"date":"2025","event":"James Greenwood, former CTOO of Bitstamp, named CEO of M2, marking a second CEO transition within the platform's first eighteen months.","source":""}],"sources_used":[{"url":"https://beincrypto.com/learn/m2-review/","name":"beincrypto.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://www.adgm.com/media/announcements/virtual-assets-trading-platform-m2-receives-financial-services-permission-from-adgm","name":"adgm.com","type":"other","archive_url":"http://web.archive.org/web/20260307081704/https://www.adgm.com/media/announcements/virtual-assets-trading-platform-m2-receives-financial-services-permission-from-adgm","credibility":3,"archive_timestamp":"2026-03-07T08:17:04+00:00"},{"url":"https://skynet.certik.com/projects/m2-exchange","name":"skynet.certik.com","type":"other","archive_url":"https://web.archive.org/web/20260829041010/https://skynet.certik.com/projects/m2-exchange","credibility":3,"archive_timestamp":"2026-08-29T04:10:10+00:00"},{"url":"https://www.fintechfutures.com/job-cuts-new-hires/crypto-platform-m2-reshuffles-leadership-with-ex-bitstamp-exec-james-greenwood-named-ceo","name":"fintechfutures.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://cryptoslate.com/uaes-m2-crypto-exchange-hacked-for-13-7m-assures-full-fund-recovery/","name":"cryptoslate.com","type":"other","archive_url":"http://web.archive.org/web/20260509225253/https://cryptoslate.com/uaes-m2-crypto-exchange-hacked-for-13-7m-assures-full-fund-recovery/","credibility":3,"archive_timestamp":"2026-05-09T22:52:53+00:00"},{"url":"https://www.quillaudits.com/blog/hack-analysis/m2-crypto-exchange-exploit","name":"quillaudits.com","type":"other","archive_url":"http://web.archive.org/web/20260515112654/https://www.quillaudits.com/blog/hack-analysis/m2-crypto-exchange-exploit","credibility":3,"archive_timestamp":"2026-05-15T11:26:54+00:00"},{"url":"https://www.web3isgoinggreat.com/single/m2-hack","name":"web3isgoinggreat.com","type":"other","archive_url":"http://web.archive.org/web/20251124180853/https://www.web3isgoinggreat.com/single/m2-hack","credibility":3,"archive_timestamp":"2025-11-24T18:08:53+00:00"},{"url":"https://protos.com/crypto-exchange-m2-reimburses-victims-after-14m-halloween-hack/","name":"protos.com","type":"other","archive_url":"http://web.archive.org/web/20260609153802/https://protos.com/crypto-exchange-m2-reimburses-victims-after-14m-halloween-hack/","credibility":3,"archive_timestamp":"2026-06-09T15:38:02+00:00"},{"url":"https://www.cryptopolitan.com/m2-exchange-reports-hack-restores-13-7m-in-eth-sol-and-btc/","name":"cryptopolitan.com","type":"other","archive_url":"https://web.archive.org/web/20260829085327/https://www.cryptopolitan.com/m2-exchange-reports-hack-restores-13-7m-in-eth-sol-and-btc/","credibility":3,"archive_timestamp":"2026-08-29T08:53:27+00:00"},{"url":"https://www.fxleaders.com/news/2024/11/02/crypto-exchange-m2-recovers-13-7-million-after-breach-resolved-in-16-minutes/","name":"fxleaders.com","type":"other","archive_url":"https://web.archive.org/web/20260829085736/https://www.fxleaders.com/news/2024/11/02/crypto-exchange-m2-recovers-13-7-million-after-breach-resolved-in-16-minutes/","credibility":3,"archive_timestamp":"2026-08-29T08:57:36+00:00"},{"url":"https://www.ccn.com/news/crypto/crypto-exchange-m2-security-breach/","name":"ccn.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://www.adgm.com/media/announcements/m2-secures-adgm-licence-and-plans-rollout-of-fully-regulated-crypto-services-to-uae","name":"adgm.com","type":"other","archive_url":"http://web.archive.org/web/20260611065234/https://www.adgm.com/media/announcements/m2-secures-adgm-licence-and-plans-rollout-of-fully-regulated-crypto-services-to-uae","credibility":3,"archive_timestamp":"2026-06-11T06:52:34+00:00"},{"url":"https://www.thenationalnews.com/business/money/2023/10/11/adgm-licensed-m2-crypto-platform-rolls-out-services-for-investors/","name":"thenationalnews.com","type":"other","archive_url":"http://web.archive.org/web/20250926105414/https://www.thenationalnews.com/business/money/2023/10/11/adgm-licensed-m2-crypto-platform-rolls-out-services-for-investors/","credibility":3,"archive_timestamp":"2025-09-26T10:54:14+00:00"}],"source_tags":["defillama"],"addresses":[],"reviewed":true,"reviewed_by":null,"model_used":"claude-code-merge-writer","created_at":"2026-05-04T02:54:27.958961+00:00","updated_at":"2026-11-01T23:16:51.053+00:00"},"source_quality":{"total":13,"tier1":0,"tier2":2,"tier3":0,"unrated":11},"follower_count":null,"content_updated_at":"2026-11-01T23:16:52.119Z","last_fact_checked_at":"2026-11-01T23:16:51.316Z","fact_check_next_allowed_at":"2026-11-08T23:16:51.316Z","update_next_allowed_at":null}