Verify a decision

{"actor":"system:backfill","investigation_id":"08e5e7b8-5d68-45ac-b345-a96eb158a784","kind":"publish","page_slug":"btcturk","published_at":"2026-05-15T03:33:01.758Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"BtcTurk","sections":[{"content":"BtcTurk was founded on July 1, 2013, by Kerem Tibuk in Istanbul, Turkey, and claims to be both Turkey's first and the world's fourth cryptocurrency exchange. The platform launched with Bitcoin-Turkish lira (BTC/TRY) trading pairs and subsequently expanded to over 90 currencies across 179 markets. By 2022, the exchange reported approximately 4.5 million registered users. In April 2022, BtcTurk was the subject of reported acquisition talks with Coinbase at a valuation of approximately $3.2 billion, though those discussions did not result in a transaction. In July 2024, CEO Ozgur Guneri stepped down after approximately seven years in the role; founder Kerem Tibuk assumed the acting CEO position, with Guneri remaining on the board. BtcTurk has historically been described as one of three exchanges dominating the Turkish domestic crypto market, alongside Paribu and Koinim.","heading":"Background and History","severity":"low","sources":[{"credibility":2,"name":"Coinbase in Talks to Acquire BtcTurk for About $3.2B: Report — CoinDesk","type":"news","url":"https://www.coindesk.com/business/2022/04/21/coinbase-in-talks-to-acquire-turkish-crypto-exchange-btcturk-for-about-32b-report"},{"credibility":1,"name":"Turkish Crypto Platform CEO Steps Down Amid Global Push — Bloomberg","type":"news","url":"https://www.bloomberg.com/news/articles/2024-07-18/turkish-crypto-platform-ceo-steps-down-amid-global-push"},{"credibility":3,"name":"BTCTurk Guide: How to Buy and Sell Crypto in Turkey — Bitget Academy","type":"other","url":"https://www.bitget.com/academy/btcturk-crypto-guide"}]},{"content":"On June 22, 2024, BtcTurk confirmed a cyberattack that caused unauthorized withdrawals from ten of its hot wallets across multiple cryptocurrency networks. The exchange stated that cold wallets — holding the majority of assets — remained unaffected and that user deposits were not directly impacted by the breach, as the stolen funds were alleged to belong to the exchange itself. On-chain investigator ZachXBT was among the first to identify and publicly report suspicious activity, tracking approximately 1.96 million AVAX tokens (valued at approximately $54.2 million at the time) being moved from an address linked to the breach to Coinbase and THORChain. ZachXBT identified the address 0x327a81d0d128db8886d265be73c9fdda97194f30 as likely affiliated with the attacker. The stolen funds were routed through multiple exchanges including Coinbase, Binance, and Gate.io, as well as through the cross-chain protocol THORChain. Binance subsequently froze approximately $5.3 million in stolen funds and assisted with the investigation. ZachXBT later concluded with high probability that the same attacker was responsible for a separate $3.5 million theft from online casino Sportsbet, which occurred hours after the BtcTurk breach. The attack is attributed to private key compromise, though the precise method by which keys were obtained — whether through phishing, malware, insecure storage, or insider access — was not confirmed publicly. The total estimated loss across independent analyses ranged from approximately $51 million to $55 million. AVAX experienced approximately a 10% price decline on the day, attributed in part to the attacker liquidating a large position.","heading":"June 2024 Hack — Private Key Compromise (~$55M)","severity":"critical","sources":[{"credibility":1,"name":"Turkey's biggest crypto exchange BtcTurk hacked — Euronews","type":"news","url":"https://www.euronews.com/next/2024/06/22/turkeys-biggest-crypto-exchange-btcturk-hacked"},{"credibility":2,"name":"Explained: The BtcTurk Hack (June 2024) — Halborn","type":"news","url":"https://www.halborn.com/blog/post/explained-the-btc-turk-hack-june-2024"},{"credibility":2,"name":"Binance freezes $5 million in funds looted from BtcTurk after alleged $54 million hack — The Block","type":"news","url":"https://www.theblock.co/post/301340/binance-freezes-5-million-in-funds-looted-from-btcturk-after-alleged-54-million-hack-of-turkish-exchange"},{"credibility":2,"name":"ZachXBT post on X identifying suspicious AVAX transfer and attacker address","type":"social","url":"https://x.com/zachxbt/status/1804481235622015187"},{"credibility":2,"name":"Avalanche's AVAX Plummets as BtcTurk Faces $54 Million Hack — BeInCrypto","type":"news","url":"https://beincrypto.com/btcturk-hack-triggers-avalanches-avax-decline/"},{"credibility":2,"name":"BTCTurk — Rekt News","type":"news","url":"https://rekt.news/btcturk-rekt"},{"credibility":3,"name":"There is a New Development in BTCTurk Hack: Hacker Attacked Another Platform — Bitcoin Sistemi","type":"news","url":"https://en.bitcoinsistemi.com/there-is-a-new-development-in-btcturk-hack-incident-hacker-attacked-another-platform/"}]},{"content":"In August 2025, approximately 14 months after the June 2024 incident, BtcTurk suffered a second major hot wallet breach. Blockchain security firm Cyvers first detected suspicious outflows on August 14, 2025, across seven blockchain networks: Ethereum, Avalanche, Arbitrum, Base, Optimism, Mantle, and Polygon. BtcTurk suspended all cryptocurrency deposits and withdrawals, initially attributing the halt to a 'technical issue' in hot wallets, before confirming the incident as a security breach and notifying law enforcement. Total estimated losses across independent analyses ranged from approximately $48 million to $51.7 million. The attack methodology was near-identical to the June 2024 incident: attackers obtained private keys controlling hot wallet accounts, then converted over 90 different token types into liquid ETH through rapid swaps before consolidating funds across a small number of addresses. Key attacker and consolidation addresses identified by blockchain analysts include: 0x7d91d1ebeba91257733a523409125aedac5d8b6e, 0xb4b537626e21df5386cf167d1e654b38785056cc, and 0xa041feb3a8297c5689fee180083164a061a17fd6, with consolidated destinations at 0xddfa0884f32d0d210597a996060fbdb5b068b0ea ($15.2M), 0x95ab53305bc71d0e6e2d46f2e62690599cbc87fc ($800K), and 0x0fe41fe8786329fb6bd8f2baa73aa55e770f0951 ($16.7M). An estimated 33.247 BTC (approximately $3.9 million) was also transferred to the Bitcoin address bc1q3xgyvmfk6mw6zvhjklsw7v8wl2dk0xtm35ulut. The exchange launched a $2.4 million bounty program — up to 5% of recovered funds — for actionable intelligence. Commentary from security researchers noted that the CEO had resigned following the 2024 breach but that private key security practices appeared not to have materially changed in the interim.","heading":"August 2025 Hack — Second Major Breach (~$48–$49M)","severity":"critical","sources":[{"credibility":1,"name":"Crypto Exchange BtcTurk Experiences $48M Worth of Suspicious Outflows Amid Hack Fears — CoinDesk","type":"news","url":"https://www.coindesk.com/business/2025/08/14/turkish-crypto-exchange-btcturk-witnesses-usd48m-of-suspicious-outflows-amid-hack-fears"},{"credibility":2,"name":"BtcTurk halts withdrawals amid suspected $48M crypto hack — CoinTelegraph","type":"news","url":"https://cointelegraph.com/news/btcturk-withdrawal-halt-hack-report"},{"credibility":2,"name":"Explained: The BtcTurk Hack (August 2025) — Halborn","type":"news","url":"https://www.halborn.com/blog/post/explained-the-btcturk-hack-august-2025"},{"credibility":2,"name":"Fund Flow Analysis of BtcTurk $48 Million Hack — Beosin","type":"news","url":"https://beosin.com/resources/fund-flow-analysis-of-btcturk-48-million-hack"},{"credibility":2,"name":"BtcTurk Faces Second Major Hack in a Year, $48M Missing from Hot Wallets — Crypto Daily","type":"news","url":"https://cryptodaily.co.uk/2025/08/btcturk-faces-second-major-hack-in-a-year-48m-missing-from-hot-wallets"},{"credibility":1,"name":"Turkish crypto exchange BTCTurk warns of security incident after $49 million leaves platform — The Record (Recorded Future)","type":"news","url":"https://therecord.media/turkish-crypto-exchange-warns-cyber-incident"},{"credibility":2,"name":"BtcTurk Launches $2.4M Recovery Bounty Program after $48M exploit — HackenProof","type":"news","url":"https://hackenproof.com/blog/for-hackers/btcturk-recovery-bounty-program"}]},{"content":"Both the June 2024 and August 2025 attacks followed a consistent pattern: private keys controlling exchange hot wallets were compromised, funds were drained across multiple EVM-compatible chains, and then rapidly liquidated through token swaps before being consolidated into a small number of destination addresses. In the June 2024 attack, the primary observable on-chain activity centered on the movement of approximately 1.96 million AVAX from the alleged attacker address 0x327a81d0d128db8886d265be73c9fdda97194f30 to Coinbase and through THORChain. Funds were also routed through Binance and Gate.io. In the August 2025 attack, blockchain security firms including Beosin, Cyvers, PeckShield, and CertiK tracked stolen assets across Ethereum, Avalanche, Arbitrum, Base, Optimism, Mantle, and Polygon. Over 90 token types were converted to ETH, with the majority consolidating into Ethereum-based wallets. As of August 18, 2025, analysts estimated approximately $51.7 million remained in identified exploiter wallets. The use of THORChain as a cross-chain bridge in the 2024 incident is consistent with techniques observed in other major exchange hacks, as it allows conversion across chains without centralized KYC checkpoints. The recurring pattern of private key compromise across two separate incidents, both involving multi-chain hot wallet drains and rapid DEX liquidation, suggests either persistent infrastructure vulnerabilities or a sophisticated persistent threat actor with continued access to BtcTurk systems.","heading":"On-Chain Analysis and Fund Flows","severity":"critical","sources":[{"credibility":2,"name":"Fund Flow Analysis of BtcTurk $48 Million Hack — Beosin","type":"onchain","url":"https://beosin.com/resources/fund-flow-analysis-of-btcturk-48-million-hack"},{"credibility":2,"name":"ZachXBT post on X — attacker address and AVAX movement to Coinbase/THORChain","type":"social","url":"https://x.com/zachxbt/status/1804481235622015187"},{"credibility":3,"name":"BtcTurk Hacked Again, This Time Losing $48 Million — Bitrue","type":"news","url":"https://www.bitrue.com/blog/btcturk-hacked-again"},{"credibility":2,"name":"Avalanche's AVAX down 10% following BtcTurk exchange hack — CryptoBriefing","type":"news","url":"https://cryptobriefing.com/avax-price-drop-btcturk-hack/"}]},{"content":"BtcTurk operates under Turkish financial regulation and is widely described as one of three licensed exchanges dominating the Turkish market. The Capital Markets Board of Turkey (Sermaye Piyasası Kurulu, or CMB) became the primary licensing authority for crypto asset service providers (CASPs) following a July 2024 legislative update. Under that framework, exchanges must meet minimum capital thresholds — approximately TRY 150 million (roughly $4.1 million) for trading platforms — and obtain a formal operating license by June 30, 2026. BtcTurk, as an incumbent operator, is listed on the CMB's active entities list and falls within the transition window for full licensing. The Financial Crimes Investigation Board of Turkey (Mali Suçları Araştırma Kurulu, or MASAK) serves as the AML/CFT enforcement authority, requiring exchanges to implement KYC protocols and report suspicious transactions. A December 2024 MASAK regulation introduced user identification requirements for crypto transactions exceeding 15,000 Turkish lira (approximately $425). No public record was found of MASAK initiating enforcement action specifically against BtcTurk. The occurrence of two major hacks within the MASAK/CMB oversight period raises questions about whether either regulator has reviewed BtcTurk's hot wallet security standards as part of their supervisory functions, though no public regulatory findings on this point were identified.","heading":"Regulatory Standing — CMB and MASAK","severity":"medium","sources":[{"credibility":3,"name":"Crypto Exchange Licensing in Turkey: What You Need to Know in 2026 — AINFP","type":"news","url":"https://ainfp.org/crypto-exchange-licensing-in-turkey-what-you-need-to-know-in"},{"credibility":2,"name":"Travel Rule Crypto in Turkey by the MASAK — Notabene","type":"official","url":"https://notabene.id/world/turkey"},{"credibility":2,"name":"Secondary Regulations On Crypto Asset Service Providers Published — Mondaq","type":"official","url":"https://www.mondaq.com/turkey/fin-tech/1601060/secondary-regulations-on-crypto-asset-service-providers-published"},{"credibility":2,"name":"Is Crypto Legal in Turkey? Regulations and Compliance — Lightspark","type":"news","url":"https://www.lightspark.com/knowledge/is-crypto-legal-in-turkey"}]},{"content":"Following the June 2024 hack, Binance CEO Richard Teng publicly announced that Binance was assisting BtcTurk with the investigation and had frozen over $5.3 million in stolen funds identified on the Binance platform. This represented approximately 10% of the estimated stolen amount. The cooperation was publicly credited to Binance's on-chain monitoring capabilities and its relationship with the Turkish exchange. No comparable public announcement of a Binance freeze was identified for the August 2025 incident at the time of this investigation. ZachXBT, an independent on-chain investigator, played a significant role in both incidents by identifying suspicious wallet addresses, tracking fund movements, and publicly attributing the June 2024 attack to the same actor responsible for the Sportsbet casino hack that occurred hours later. Third-party blockchain security firms Cyvers, PeckShield, CertiK, and Beosin also provided public on-chain analysis of both incidents.","heading":"Binance Cooperation and Industry Response","severity":"medium","sources":[{"credibility":2,"name":"Binance Intercepts $5M in Stolen Funds from BtcTurk Hack — DailyCoin","type":"news","url":"https://dailycoin.com/binance-intercepts-funds-btcturk-hack/"},{"credibility":2,"name":"Explained: The BtcTurk Hack (June 2024) — Halborn","type":"news","url":"https://www.halborn.com/blog/post/explained-the-btc-turk-hack-june-2024"},{"credibility":2,"name":"ZachXBT post on X — BtcTurk hot wallet hack identification","type":"social","url":"https://x.com/zachxbt/status/1804481235622015187"}]},{"content":"The occurrence of two material private key compromises within 14 months — resulting in combined estimated losses of approximately $103–$107 million — constitutes a pattern that distinguishes BtcTurk from single-incident exchange hacks. Security researchers at Rekt News and Halborn have both noted that the August 2025 attack employed a near-identical methodology to the June 2024 breach. The departure of CEO Ozgur Guneri in July 2024 — one month after the first breach — did not appear to result in material changes to hot wallet key management practices, based on the recurrence of the same attack vector. Both incidents involved hot wallet private key exfiltration followed by multi-chain fund drainage and rapid liquidation through DEXes and cross-chain bridges. The exchange has publicly maintained in both incidents that cold wallets and user funds remained unaffected, attributing losses to exchange-owned operational wallets. However, the credibility of these assurances is diminished by the repeated failure to secure the hot wallet infrastructure. The $2.4 million bounty program launched after the August 2025 hack (representing up to 5% of stolen assets) has not resulted in publicly confirmed recoveries as of the date of this investigation.","heading":"Security Pattern and Systemic Risk Assessment","severity":"critical","sources":[{"credibility":2,"name":"BTCTurk — Rekt News","type":"news","url":"https://rekt.news/btcturk-rekt"},{"credibility":2,"name":"Explained: The BtcTurk Hack (August 2025) — Halborn","type":"news","url":"https://www.halborn.com/blog/post/explained-the-btcturk-hack-august-2025"},{"credibility":2,"name":"BtcTurk Faces Second Major Hack in a Year — Crypto Daily","type":"news","url":"https://cryptodaily.co.uk/2025/08/btcturk-faces-second-major-hack-in-a-year-48m-missing-from-hot-wallets"},{"credibility":3,"name":"BtcTurk Hacked Again, This Time Losing $48 Million - Trust Issues Spread — Bitrue","type":"news","url":"https://www.bitrue.com/blog/btcturk-hacked-again"},{"credibility":2,"name":"BtcTurk Launches $2.4M Recovery Bounty Program after $48M exploit — HackenProof","type":"news","url":"https://hackenproof.com/blog/for-hackers/btcturk-recovery-bounty-program"}]}],"sources_used":[],"summary":"BtcTurk is Turkey's oldest and largest centralized cryptocurrency exchange, founded in 2013 in Istanbul. The exchange has suffered two major hot wallet breaches in 14 months — approximately $55 million stolen in June 2024 and approximately $48–$49 million in August 2025 — both attributed to private key compromise, establishing a pattern of repeated critical security failures. Despite operating under Turkish regulatory frameworks (CMB and MASAK) and maintaining cold wallet protections, the exchange's inability to prevent a second near-identical attack within a year raises serious concerns about the adequacy of its security controls.","timeline":[{"date":"2013-07","event":"BtcTurk founded by Kerem Tibuk in Istanbul, Turkey. Claims to be the world's fourth cryptocurrency exchange and Turkey's first.","source":"Bitget Academy — BTCTurk Guide","source_url":"https://www.bitget.com/academy/btcturk-crypto-guide"},{"date":"2022-04","event":"Reports emerge that Coinbase is in acquisition talks with BtcTurk at a valuation of approximately $3.2 billion. No transaction results.","source":"CoinDesk","source_url":"https://www.coindesk.com/business/2022/04/21/coinbase-in-talks-to-acquire-turkish-crypto-exchange-btcturk-for-about-32b-report"},{"date":"2024-06","event":"BtcTurk suffers a cyberattack on June 22, 2024. Private keys controlling ten hot wallets are compromised. Estimated $55 million stolen across multiple cryptocurrencies including AVAX, ETH, ARB, and others. ZachXBT identifies attacker address and AVAX movements to Coinbase and THORChain.","source":"Euronews / Halborn / ZachXBT","source_url":"https://www.euronews.com/next/2024/06/22/turkeys-biggest-crypto-exchange-btcturk-hacked"},{"date":"2024-06","event":"Binance freezes approximately $5.3 million in stolen funds and assists with investigation. ZachXBT links the BtcTurk attacker to a contemporaneous $3.5 million hack of Sportsbet casino.","source":"The Block / DailyCoin","source_url":"https://dailycoin.com/binance-intercepts-funds-btcturk-hack/"},{"date":"2024-07","event":"CEO Ozgur Guneri resigns after approximately seven years. Founder Kerem Tibuk assumes acting CEO role. Guneri remains on the board.","source":"Bloomberg","source_url":"https://www.bloomberg.com/news/articles/2024-07-18/turkish-crypto-platform-ceo-steps-down-amid-global-push"},{"date":"2024-07","event":"Turkish Parliament enacts legislation formally requiring crypto asset service providers to obtain operating licenses from the Capital Markets Board (CMB).","source":"Lightspark","source_url":"https://www.lightspark.com/knowledge/is-crypto-legal-in-turkey"},{"date":"2024-12","event":"MASAK introduces regulation requiring user identification for crypto transactions exceeding 15,000 Turkish lira (approximately $425).","source":"Notabene — Travel Rule Turkey","source_url":"https://notabene.id/world/turkey"},{"date":"2025-03","event":"CMB publishes secondary communiques formalizing CASP licensing requirements. Full compliance required by June 30, 2026.","source":"Mondaq","source_url":"https://www.mondaq.com/turkey/fin-tech/1601060/secondary-regulations-on-crypto-asset-service-providers-published"},{"date":"2025-08","event":"BtcTurk suffers a second major hot wallet breach on August 14, 2025 — approximately 14 months after the 2024 incident. Private key compromise across seven blockchain networks results in an estimated $48–$49 million stolen. Exchange suspends deposits and withdrawals and notifies law enforcement.","source":"CoinDesk / The Record","source_url":"https://www.coindesk.com/business/2025/08/14/turkish-crypto-exchange-btcturk-witnesses-usd48m-of-suspicious-outflows-amid-hack-fears"},{"date":"2025-08","event":"BtcTurk launches a $2.4 million recovery bounty program offering up to 5% of recovered funds for actionable intelligence.","source":"HackenProof","source_url":"https://hackenproof.com/blog/for-hackers/btcturk-recovery-bounty-program"}]},"v":1}