{"investigation":{"slug":"poloniex","entity_name":"Poloniex","trust_score":10,"severity_base":null,"score_modifier":0,"confidence":1,"status":"published","content_type":"investigation","summary":"Poloniex is a cryptocurrency exchange founded in 2014 and acquired in 2019 by an investor group led by Tron founder Justin Sun. On November 10, 2023, the exchange suffered one of the largest hot wallet compromises in crypto history, with attackers draining approximately $126 million across Ethereum, TRON, and Bitcoin networks in an attack attributed by multiple blockchain security firms to North Korea's Lazarus Group. The exchange has also faced significant regulatory enforcement actions, including a $7.59 million OFAC sanctions settlement and a $10.4 million SEC settlement for operating an unregistered national securities exchange.","sections":[{"content":"Poloniex was founded in January 2014 by Tristan D'Agosta and quickly became one of the leading altcoin trading platforms in the early cryptocurrency ecosystem, notable for its extensive asset listings and margin trading capabilities. The exchange was acquired by Circle Internet Financial in February 2018 for an estimated $400 million. Under Circle's ownership, Poloniex delisted assets that could be classified as securities and implemented KYC procedures to comply with U.S. regulatory requirements. In October 2019, Circle spun out Poloniex as an independent entity — Polo Digital Assets, Ltd. — backed by an Asian investor group. Poloniex simultaneously ceased service to U.S. customers, with November 1, 2019 as the final trading date and December 15, 2019 as the final withdrawal deadline for U.S. users. As of 2025–2026, the exchange continues to operate internationally, with ongoing asset delistings and occasional service disruptions.","heading":"Background","sources":[{"url":"https://www.bitget.com/academy/12560603878185","name":"","type":"other","credibility":3},{"url":"https://coinledger.io/blog/us-residents-losing-access-to-poloniex","name":"","type":"other","credibility":3}],"severity":"medium"},{"content":"In October 2019, reports emerged that Tron founder Justin Sun was leading an investor group to acquire Poloniex from Circle. Sun initially denied involvement, but on November 12, 2019, confirmed his participation in a live stream posted to Poloniex's official Twitter profile. Sun characterized Tron as one of several investors, stating the exchange would operate independently from his company. Despite the independence claim, Poloniex subsequently displayed a strong TRON ecosystem focus. Justin Sun is also the controlling figure behind HTX (formerly Huobi), and in 2023 his affiliated platforms were hacked four times within roughly two months — including the $126 million Poloniex breach in November, a $30 million HTX exploit in November, an $8 million HTX exploit in September, and an $85 million Heco Chain bridge exploit in November — raising sustained questions about security culture across Sun-affiliated exchanges. Sun responded to each incident with pledges of full reimbursement and offers of white-hat bounties to the attackers.","heading":"Justin Sun Acquisition","sources":[{"url":"https://www.coindesk.com/markets/2019/11/12/despite-denials-tron-founder-confirms-investment-in-poloniex-crypto-exchange","name":"","type":"other","credibility":3},{"url":"https://cointelegraph.com/news/justin-sun-platforms-hacked-4-times","name":"","type":"other","credibility":3},{"url":"https://www.cnbc.com/2023/11/23/htx-heco-chain-crypto-hack-115-million-stolen-so-far.html","name":"","type":"other","credibility":3}],"severity":"medium"},{"content":"On November 10, 2023, beginning at approximately 10:30 AM UTC, unauthorized parties began draining funds from Poloniex hot wallets across multiple blockchains. Blockchain security firm PeckShield initially flagged the abnormal outflows; Arkham Intelligence subsequently tracked fund movements across chains. The attack compromised hot wallets on the Ethereum, TRON, and Bitcoin networks. Losses were distributed as follows: approximately $56 million on Ethereum, $48 million on TRON (including approximately 288 million TRX tokens), and approximately $18 million in Bitcoin (865 BTC). Assets stolen included ETH, USDT, TUSD, TRX, and a range of ERC-20 and TRC-20 tokens including meme coins PEPE, FLOKI, and SHIB. In total, attackers interacted with at least 317 distinct ERC-20 token contracts. The root cause was identified as a compromise of hot wallet private keys, enabling attackers to sign and broadcast unauthorized transactions. The exact method of key exfiltration — whether through social engineering, malware, or internal access — was not publicly confirmed by Poloniex. Justin Sun publicly stated the exchange maintained 'a healthy financial position' and pledged full reimbursement of all affected funds. Sun also offered the attacker a 5% white-hat bounty — approximately $6.3 million — in exchange for returning the stolen assets within seven days. The offer was not accepted. One notable on-chain error by the attacker: over 10.5 million GLM (Golem) tokens worth approximately $2.6 million were inadvertently sent to the Golem Network Token contract address rather than the attacker's own wallet.","heading":"The $126M Hack","sources":[{"url":"https://decrypt.co/205465/justin-sun-owned-crypto-exchange-poloniex-hacked-60m","name":"","type":"other","credibility":3},{"url":"https://coingape.com/poloniex-hack-total-funds-stolen-reaches-over-126-million-btc-eth-shib-most-impacted/","name":"","type":"other","credibility":3},{"url":"https://www.halborn.com/blog/post/explained-the-poloniex-hack-november-2023","name":"","type":"other","credibility":3},{"url":"https://www.certik.com/resources/blog/poloniex-incident-analysis","name":"","type":"other","credibility":3},{"url":"https://dailyhodl.com/2023/11/10/tron-founder-justin-sun-offers-5-cut-to-hacker-after-poloniex-crypto-exchange-loses-125000000-in-cyber-heist/","name":"","type":"other","credibility":3}],"severity":"medium"},{"content":"Post-hack on-chain analysis by multiple security firms, including CertiK and Halborn, identified behavioral patterns consistent with the North Korean state-sponsored threat actor commonly known as Lazarus Group. The group's alleged signature includes: routing different token types to specialized intermediate addresses; swapping ERC-20 and TRC-20 tokens for native assets (ETH, TRX) via decentralized exchanges before forwarding to final destinations; and use of sanctioned mixing services to obscure fund origins. In this case, the attacker transferred approximately 1,100 ETH (valued at roughly $3.4 million at the time) to Tornado Cash, a cryptocurrency mixer that has been sanctioned by OFAC since August 2022. Stolen funds passed through at least 681 wallets across Ethereum and TRON before laundering attempts. Bitdefender and other firms tracked early movement of approximately $18 million in Bitcoin shortly after the initial breach. A subsequent transfer of approximately $32 million in Bitcoin from the hacker's holdings was reported by CryptoNews. Lazarus Group attribution for the Poloniex hack is alleged by multiple security researchers and firms based on on-chain behavioral patterns, but has not been formally confirmed by U.S. law enforcement or attributed in a government indictment as of the research date.","heading":"On-Chain Evidence","sources":[{"url":"https://www.halborn.com/blog/post/explained-the-poloniex-hack-november-2023","name":"","type":"other","credibility":3},{"url":"https://www.bitdefender.com/en-us/blog/hotforsecurity/poloniex-hackers-have-begun-to-move-some-of-the-stolen-120-million","name":"","type":"other","credibility":3},{"url":"https://cryptonews.com/news/poloniex-hacker-transfers-massive-32-million-bitcoin-stash/","name":"","type":"other","credibility":3},{"url":"https://digifinex.medium.com/poloniex-heist-possibly-linked-to-north-korean-lazarus-group-justin-sun-claims-losses-within-cf4a00de8d84","name":"","type":"other","credibility":3},{"url":"https://hacken.io/discover/lazarus-group/","name":"","type":"other","credibility":3}],"severity":"medium"},{"content":"Poloniex has faced enforcement actions from multiple U.S. regulators. In August 2021, the SEC charged Poloniex LLC with operating an unregistered national securities exchange. The SEC found that between July 2017 and November 2019, Poloniex facilitated the trading of digital assets that constituted investment contracts and therefore securities, in violation of Section 5 of the Securities Exchange Act of 1934. Without admitting or denying the findings, Poloniex agreed to pay total disgorgement, interest, and civil penalties of $10,388,309. The SEC established a Fair Fund for the benefit of affected investors. In May 2023, the U.S. Department of the Treasury's Office of Foreign Assets Control (OFAC) announced a $7.59 million settlement with Poloniex for approximately 65,942 apparent sanctions violations spanning January 2014 through November 2019. The violations arose from Poloniex allowing users located in Crimea, Cuba, Iran, Sudan, and Syria to conduct cryptocurrency transactions totaling approximately $15 million. The base civil monetary penalty was calculated at approximately $98.8 million; mitigating factors — including Poloniex's status as a small startup during most of the violation period, Circle's subsequent compliance improvements, and voluntary cooperation — reduced the final settlement. The SEC order noted that at the time of the settlement, 'Poloniex currently has no business operations and no employees,' a reference to the entity that held the exchange during the Circle ownership period. In 2019, Poloniex halted services to Ontario, Canada users, and in October 2019 ceased service to all U.S. customers ahead of regulatory pressure.","heading":"Regulatory Issues","sources":[{"url":"https://www.sec.gov/newsroom/press-releases/2021-147","name":"","type":"other","credibility":3},{"url":"https://www.coindesk.com/policy/2021/08/09/poloniex-agrees-to-10m-settlement-with-sec-for-operating-unregistered-exchange","name":"","type":"other","credibility":3},{"url":"https://www.coindesk.com/policy/2023/05/01/crypto-exchange-poloniex-agrees-to-76m-fine-settle-sanctions-violation-charges","name":"","type":"other","credibility":3},{"url":"https://blog.volkovlaw.com/2023/05/cryptocurrency-firm-poloniex-reaches-settlement-with-ofac-and-pays-7-5-million-for-sanctions-violations/","name":"","type":"other","credibility":3}],"severity":"medium"},{"content":"Poloniex presents a high-severity risk profile for several compounding reasons. First, the exchange suffered a catastrophic $126 million hot wallet compromise in November 2023, the second-largest crypto hack of that year, indicating either severe operational security failures or insider threat exposure. The use of hot wallets to hold large quantities of user assets — rather than cold storage — is an industry risk factor. Second, attribution of the hack to Lazarus Group, if accurate, places the exchange in the category of targets that have faced sophisticated state-sponsored attackers; however, this attribution remains alleged and is not government-confirmed. Third, Justin Sun's affiliated platforms suffered four separate exploits within approximately two months in late 2023, a frequency that security researchers have characterized as anomalous and indicative of systemic security deficiencies across Sun-controlled entities. Fourth, the exchange carries a documented history of regulatory non-compliance, having settled with both the SEC (operating an unregistered securities exchange) and OFAC (enabling sanctioned-country transactions) for a combined $18 million in penalties. Fifth, Poloniex no longer serves U.S. customers, limiting regulatory accountability under U.S. law. Users in supported jurisdictions should be aware that customer funds held on the exchange were exposed to total loss in the November 2023 incident, and that Justin Sun's pledge to fully reimburse affected users has not been independently verified as complete. As of 2026, the exchange continues to operate with ongoing asset delistings, suggesting a contracting rather than growing platform.","heading":"Risk Assessment","sources":[{"url":"https://siliconangle.com/2023/11/10/justin-suns-poloniex-exchange-hit-100m-exploit/","name":"","type":"other","credibility":3},{"url":"https://cointelegraph.com/news/justin-sun-platforms-hacked-4-times","name":"","type":"other","credibility":3},{"url":"https://www.disruptionbanking.com/2023/11/27/poloniex-offers-white-hat-bounty-to-black-hat-hackers-in-largest-crypto-attack-of-2023/","name":"","type":"other","credibility":3}],"severity":"medium"}],"timeline":[{"date":"2014","event":"Poloniex founded by Tristan D'Agosta; exchange opens for trading.","source":"","date_original":"2014-01-01"},{"date":"2014-03","event":"Poloniex suffers its first hack, losing approximately 12.3% of its Bitcoin holdings.","source":"","date_original":"2014-03-01"},{"date":"2018-02","event":"Circle Internet Financial acquires Poloniex for approximately $400 million.","source":"","date_original":"2018-02-01"},{"date":"2019-10","event":"Poloniex spins out from Circle as Polo Digital Assets, Ltd., backed by an Asian investor group including Justin Sun. U.S. customers notified of service termination.","source":"","date_original":"2019-10-01"},{"date":"2019-11-12","event":"Justin Sun publicly confirms his investment in Poloniex via a live stream on Poloniex's official Twitter profile.","source":""},{"date":"2019-12-15","event":"Final deadline for U.S. users to withdraw funds from Poloniex.","source":""},{"date":"2021-08-09","event":"SEC charges Poloniex with operating an unregistered national securities exchange; Poloniex settles for $10,388,309.","source":""},{"date":"2023-05","event":"OFAC announces $7.59 million settlement with Poloniex for approximately 65,942 apparent sanctions violations involving users in Crimea, Cuba, Iran, Sudan, and Syria.","source":"","date_original":"2023-05-01"},{"date":"2023-09-24","event":"Justin Sun's HTX exchange (formerly Huobi) suffers a $8 million hack.","source":""},{"date":"2023-11-10","event":"Poloniex hot wallets on Ethereum, TRON, and Bitcoin are compromised; approximately $126 million drained. Justin Sun pledges full reimbursement and offers a 5% bounty to the attackers.","source":""},{"date":"2023-11-14","event":"Hackers begin moving stolen funds; approximately 1,100 ETH sent to Tornado Cash mixer.","source":""},{"date":"2023-11-23","event":"HTX and Heco Chain suffer additional exploits totaling approximately $115 million, bringing total losses across Sun-affiliated platforms to over $240 million in roughly two months.","source":""},{"date":"2024-04-12","event":"Poloniex announces bulk asset delistings, signaling platform contraction.","source":""},{"date":"2024-08-23","event":"Further bulk asset delistings announced by Poloniex.","source":""},{"date":"2024-11-07","event":"Additional bulk delistings; platform continues to reduce listed assets.","source":""}],"sources_used":[{"url":"https://www.bitget.com/academy/12560603878185","name":"","type":"other","archive_url":null,"credibility":3,"archive_error":"error:not-found","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://coinledger.io/blog/us-residents-losing-access-to-poloniex","name":"","type":"other","archive_url":"http://web.archive.org/web/20260417152111/https://coinledger.io/blog/us-residents-losing-access-to-poloniex","credibility":3,"archive_timestamp":"2026-04-17T15:21:11+00:00"},{"url":"https://www.coindesk.com/markets/2019/11/12/despite-denials-tron-founder-confirms-investment-in-poloniex-crypto-exchange","name":"","type":"other","archive_url":"http://web.archive.org/web/20251118212936/https://www.coindesk.com/markets/2019/11/12/despite-denials-tron-founder-confirms-investment-in-poloniex-crypto-exchange","credibility":3,"archive_timestamp":"2025-11-18T21:29:36+00:00"},{"url":"https://cointelegraph.com/news/justin-sun-platforms-hacked-4-times","name":"","type":"other","archive_url":"http://web.archive.org/web/20260318124534/https://cointelegraph.com/news/justin-sun-platforms-hacked-4-times","credibility":3,"archive_timestamp":"2026-03-18T12:45:34+00:00"},{"url":"https://www.cnbc.com/2023/11/23/htx-heco-chain-crypto-hack-115-million-stolen-so-far.html","name":"","type":"other","archive_url":"http://web.archive.org/web/20260522060819/https://www.cnbc.com/2023/11/23/htx-heco-chain-crypto-hack-115-million-stolen-so-far.html","credibility":3,"archive_timestamp":"2026-05-22T06:08:19+00:00"},{"url":"https://decrypt.co/205465/justin-sun-owned-crypto-exchange-poloniex-hacked-60m","name":"","type":"other","archive_url":"http://web.archive.org/web/20260719162226/https://decrypt.co/205465/justin-sun-owned-crypto-exchange-poloniex-hacked-60m","credibility":3,"archive_timestamp":"2026-07-19T16:22:26+00:00"},{"url":"https://coingape.com/poloniex-hack-total-funds-stolen-reaches-over-126-million-btc-eth-shib-most-impacted/","name":"","type":"other","archive_url":null,"credibility":3,"archive_timestamp":null},{"url":"https://www.halborn.com/blog/post/explained-the-poloniex-hack-november-2023","name":"","type":"other","archive_url":"http://web.archive.org/web/20260609211426/https://www.halborn.com/blog/post/explained-the-poloniex-hack-november-2023","credibility":3,"archive_timestamp":"2026-06-09T21:14:26+00:00"},{"url":"https://www.certik.com/resources/blog/poloniex-incident-analysis","name":"","type":"other","archive_url":"http://web.archive.org/web/20250815125809/https://www.certik.com/resources/blog/poloniex-incident-analysis","credibility":3,"archive_timestamp":"2025-08-15T12:58:09+00:00"},{"url":"https://dailyhodl.com/2023/11/10/tron-founder-justin-sun-offers-5-cut-to-hacker-after-poloniex-crypto-exchange-loses-125000000-in-cyber-heist/","name":"","type":"other","archive_url":"http://web.archive.org/web/20251208040423/https://dailyhodl.com/2023/11/10/tron-founder-justin-sun-offers-5-cut-to-hacker-after-poloniex-crypto-exchange-loses-125000000-in-cyber-heist/","credibility":3,"archive_timestamp":"2025-12-08T04:04:23+00:00"},{"url":"https://www.bitdefender.com/en-us/blog/hotforsecurity/poloniex-hackers-have-begun-to-move-some-of-the-stolen-120-million","name":"","type":"other","archive_url":"https://web.archive.org/web/20260830003437/https://www.bitdefender.com/en-us/blog/hotforsecurity/poloniex-hackers-have-begun-to-move-some-of-the-stolen-120-million","credibility":3,"archive_timestamp":"2026-08-30T00:34:37+00:00"},{"url":"https://cryptonews.com/news/poloniex-hacker-transfers-massive-32-million-bitcoin-stash/","name":"","type":"other","archive_url":null,"credibility":3,"archive_timestamp":null},{"url":"https://digifinex.medium.com/poloniex-heist-possibly-linked-to-north-korean-lazarus-group-justin-sun-claims-losses-within-cf4a00de8d84","name":"","type":"other","archive_url":"http://web.archive.org/web/20250911102617/https://digifinex.medium.com/poloniex-heist-possibly-linked-to-north-korean-lazarus-group-justin-sun-claims-losses-within-cf4a00de8d84","credibility":3,"archive_timestamp":"2025-09-11T10:26:17+00:00"},{"url":"https://hacken.io/discover/lazarus-group/","name":"","type":"other","archive_url":"http://web.archive.org/web/20260608054821/https://hacken.io/discover/lazarus-group/","credibility":3,"archive_timestamp":"2026-06-08T05:48:21+00:00"},{"url":"https://www.sec.gov/newsroom/press-releases/2021-147","name":"","type":"other","archive_url":"http://web.archive.org/web/20260614063137/https://www.sec.gov/newsroom/press-releases/2021-147","credibility":3,"archive_timestamp":"2026-06-14T06:31:37+00:00"},{"url":"https://www.coindesk.com/policy/2021/08/09/poloniex-agrees-to-10m-settlement-with-sec-for-operating-unregistered-exchange","name":"","type":"other","archive_url":"http://web.archive.org/web/20260726005308/https://www.coindesk.com/policy/2021/08/09/poloniex-agrees-to-10m-settlement-with-sec-for-operating-unregistered-exchange","credibility":3,"archive_timestamp":"2026-07-26T00:53:08+00:00"},{"url":"https://www.coindesk.com/policy/2023/05/01/crypto-exchange-poloniex-agrees-to-76m-fine-settle-sanctions-violation-charges","name":"","type":"other","archive_url":"http://web.archive.org/web/20260301130930/https://www.coindesk.com/policy/2023/05/01/crypto-exchange-poloniex-agrees-to-76m-fine-settle-sanctions-violation-charges","credibility":3,"archive_timestamp":"2026-03-01T13:09:30+00:00"},{"url":"https://blog.volkovlaw.com/2023/05/cryptocurrency-firm-poloniex-reaches-settlement-with-ofac-and-pays-7-5-million-for-sanctions-violations/","name":"","type":"other","archive_url":"http://web.archive.org/web/20260416083509/https://blog.volkovlaw.com/2023/05/cryptocurrency-firm-poloniex-reaches-settlement-with-ofac-and-pays-7-5-million-for-sanctions-violations/","credibility":3,"archive_timestamp":"2026-04-16T08:35:09+00:00"},{"url":"https://siliconangle.com/2023/11/10/justin-suns-poloniex-exchange-hit-100m-exploit/","name":"","type":"other","archive_url":"http://web.archive.org/web/20260724172748/https://siliconangle.com/2023/11/10/justin-suns-poloniex-exchange-hit-100m-exploit/","credibility":3,"archive_timestamp":"2026-07-24T17:27:48+00:00"},{"url":"https://www.disruptionbanking.com/2023/11/27/poloniex-offers-white-hat-bounty-to-black-hat-hackers-in-largest-crypto-attack-of-2023/","name":"","type":"other","archive_url":"http://web.archive.org/web/20251208042333/https://www.disruptionbanking.com/2023/11/27/poloniex-offers-white-hat-bounty-to-black-hat-hackers-in-largest-crypto-attack-of-2023/","credibility":3,"archive_timestamp":"2025-12-08T04:23:33+00:00"}],"source_tags":["defillama"],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-sonnet-4-5","created_at":"2026-05-04T02:54:37.207673+00:00","updated_at":"2026-08-30T01:16:29.403735+00:00"}}