Verify a decision

{"actor":"system:backfill","investigation_id":"1eeadbe2-acbf-4170-a5c4-155c66503ee2","kind":"publish","page_slug":"heco-bridge-htx","published_at":"2026-06-01T17:48:07.362Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"HECO Bridge & HTX Exchange Hack","sections":[{"content":"At approximately 21:00 UTC on November 22, 2023, on-chain security monitoring firms detected anomalous outflows from both the HECO Chain cross-chain bridge and the HTX exchange's hot wallets. The HECO bridge drained 10,145 ETH, 42,110,000 USDT, 489 HBTC, 346,867,120,000 SHIB, 173,200 UNI, 619,000 USDC, 42,399 LINK, and 346,994 TUSD — totaling approximately $87 million. Separately, HTX hot wallets on Ethereum and TRON were drained of approximately $13.6 million and $12.6 million respectively, for additional losses of roughly $26 million. CertiK's analysis confirmed that all transactions originated from the HECO bridge operator wallet at address 0x3d655889D197125fb90dcB72e4a287A8410ED1B9, which called the privileged withdrawToken function. Because that function is restricted to the operator address, the root cause was assessed as a private key compromise rather than a smart contract vulnerability. Total confirmed losses across both incidents reached approximately $113 million.","heading":"The November 22, 2023 Simultaneous Exploits","severity":"critical","sources":[{"credibility":2,"name":"CertiK — Heco Bridge Exploit","type":"research","url":"https://www.certik.com/resources/blog/heco-bridge-exploit"},{"credibility":2,"name":"Blockworks — Huobi's Heco chain bridge drained of $87M in crypto assets","type":"news_article","url":"https://blockworks.co/news/htx-hack-ethereum-crypto-assets"},{"credibility":1,"name":"CoinDesk — Justin Sun Confirms HTX, Heco Chain Exploited After $100M in Suspicious Transfers","type":"news_article","url":"https://www.coindesk.com/tech/2023/11/22/justin-sun-confirms-htx-heco-chain-exploited-after-100m-in-suspicious-transfers"},{"credibility":2,"name":"ImmuneBytes — HECO Bridge Exploited for Over $87M in a Suspected Private Key Leak","type":"research","url":"https://immunebytes.com/blog/heco-bridge-exploited-for-over-87m-in-a-suspected-private-key-leak/"}]},{"content":"Security firms CertiK, Hacken, and ImmuneBytes each independently assessed that the HECO bridge operator wallet was compromised via a private key leak rather than a code exploit. The bridge's withdrawToken function is gated to a single operator address; by obtaining that private key, the attacker could execute arbitrary token withdrawals with no additional on-chain constraints. Stolen tokens were immediately converted to ETH using decentralized exchanges, a laundering pattern characteristic of sophisticated state-sponsored actors. The main exploiter wallet identified on-chain is 0xe47e6dA16Bb83EB0FD26b3F29b15CE8Fab089B9e ('Heco Bridge Exploiter 2'), which distributed 23,574 ETH across four secondary wallets. A separate holding address, 0xe47e6dA16Bb83EB0FD26b3F29b15CE8Fab089B9e, held approximately $63 million at peak. How the private key was exfiltrated — whether through phishing, insider access, or infrastructure compromise — has not been publicly confirmed by HTX or the HECO development team.","heading":"Technical Root Cause: Private Key Compromise","severity":"critical","sources":[{"credibility":2,"name":"Hacken — Heco Bridge Hack Explained","type":"research","url":"https://hacken.io/insights/heco-bridge-hack-explained/"},{"credibility":2,"name":"CertiK — Heco Bridge Exploit","type":"research","url":"https://www.certik.com/resources/blog/heco-bridge-exploit"},{"credibility":2,"name":"Olympix — Heco Bridge Hack Analysis","type":"research","url":"https://olympixai.medium.com/heco-bridge-hack-analysis-64cffda76684"}]},{"content":"Blockchain intelligence firm Elliptic attributed the November 22, 2023 HECO bridge and HTX hack to North Korea's Lazarus Group, citing behavioral attributes of the hack and subsequent fund movement patterns consistent with prior Lazarus operations. After a dormancy period of approximately three months, laundering activity began on March 13, 2024. Over $145 million in ETH from the exploit was processed through the sanctioned Ethereum mixer Tornado Cash within eight days, according to analysis by The Block and CoinTelegraph. Elliptic separately reported that approximately $12 million was moved through Tornado Cash in a distinct tranche attributed to Lazarus. The group's return to Tornado Cash — which the U.S. Treasury sanctioned in August 2022 — was attributed to the limited availability of large-scale mixers following law enforcement seizures of Sinbad.io and Blender.io in late 2023. This attribution has not been officially confirmed by U.S. government agencies such as the FBI or OFAC as of the time of writing, and should be treated as alleged.","heading":"Lazarus Group Attribution and Post-Hack Laundering","severity":"critical","sources":[{"credibility":2,"name":"Elliptic — North Korean Hackers Return to Tornado Cash Despite Sanctions","type":"research","url":"https://www.elliptic.co/blog/north-korean-hackers-return-to-tornado-cash-despite-sanctions"},{"credibility":1,"name":"CoinDesk — North Korean Hackers Used Tornado Cash to Launder $12M From Heco Bridge Hack: Elliptic","type":"news_article","url":"https://www.coindesk.com/business/2024/03/14/north-korean-hackers-used-tornado-cash-to-launder-12m-from-heco-bridge-hack-elliptic"},{"credibility":2,"name":"The Block — Heco Bridge exploiters launder over $145 million in ether via Tornado Cash","type":"news_article","url":"https://www.theblock.co/post/284107/heco-bridge-exploiters-launder-145-million-usd-eth-tornado-cash"},{"credibility":2,"name":"CoinTelegraph — HECO Chain exploiter anonymizes $145M of Ether on Tornado Cash","type":"news_article","url":"https://cointelegraph.com/news/heco-exploiter-anonymizes-145-m-ether-tornado-cash"}]},{"content":"The November 22 attack occurred within a broader pattern of security failures across platforms associated with Justin Sun. On September 24, 2023, HTX (at the time recently rebranded from Huobi) lost 5,000 ETH (approximately $8 million) in a hot wallet compromise; that hacker ultimately returned the funds after accepting a 5% white hat bounty of 250 ETH. On November 10, 2023 — twelve days before the HECO/HTX attack — Justin Sun's Poloniex exchange was exploited for approximately $120–126 million, also attributed to a hot wallet compromise. The cumulative losses across the three incidents (September HTX hack, November Poloniex hack, November HECO/HTX hack) exceeded $240 million within approximately two months. Security researchers noted that the recurring nature of private key failures across multiple Sun-affiliated platforms suggested systemic deficiencies in key management practices, rather than isolated incidents.","heading":"Pattern of Security Incidents Across Justin Sun's Ecosystem","severity":"high","sources":[{"credibility":2,"name":"Halborn — Explained: The Huobi Exchange Hack (September 2023)","type":"research","url":"https://www.halborn.com/blog/post/explained-the-huobi-exchange-hack-september-2023"},{"credibility":1,"name":"CoinDesk — Crypto Exchange HTX Lost $8M of Ether Due to a Hack, Justin Sun Says","type":"news_article","url":"https://www.coindesk.com/business/2023/09/25/crypto-exchange-htx-lost-8m-of-ether-due-to-a-hack-justin-sun-says"},{"credibility":2,"name":"Decrypt — Justin Sun-Owned Exchange Poloniex Hacked for At Least $126 Million","type":"news_article","url":"https://decrypt.co/205465/justin-sun-owned-crypto-exchange-poloniex-hacked-60m"},{"credibility":1,"name":"South China Morning Post — Crypto exchange HTX suffers US$30 million hack after another platform linked to entrepreneur Justin Sun was hit","type":"news_article","url":"https://www.scmp.com/tech/big-tech/article/3242535/crypto-exchange-htx-suffers-us30-million-hack-after-another-platform-linked-entrepreneur-justin-sun"}]},{"content":"Justin Sun publicly confirmed both exploits on November 22, 2023, via social media, stating that 'HTX will fully compensate for any losses originating from the exchange' and that all remaining funds in HTX were secured. He stated HTX and HECO Chain 'operate independently' while acknowledging the simultaneous nature of the attacks. HTX suspended deposits and withdrawals immediately following the incident. Services resumed on November 25, 2023, approximately three days after the hack. Despite the compensation pledge, the exchange experienced approximately $258 million in net outflows between November 25 and December 10, 2023, reflecting a significant loss of user confidence. Sun made a similar compensation pledge after the Poloniex hack, offering a $10 million white hat bounty to the Poloniex attackers as well. Independent verification of actual compensation disbursements to affected HECO bridge users has not been publicly documented in audited form.","heading":"Justin Sun's Response and Compensation Pledges","severity":"high","sources":[{"credibility":1,"name":"CoinDesk — Justin Sun Confirms HTX, Heco Chain Exploited After $100M in Suspicious Transfers","type":"news_article","url":"https://www.coindesk.com/tech/2023/11/22/justin-sun-confirms-htx-heco-chain-exploited-after-100m-in-suspicious-transfers"},{"credibility":2,"name":"Investing.com — Justin Sun pledges to reimburse HTX users after $86.6 million HECO Chain exploit","type":"news_article","url":"https://ng.investing.com/news/stock-market-news/justin-sun-pledges-to-reimburse-htx-users-after-866-million-heco-chain-exploit-93CH-1150520"},{"credibility":2,"name":"CoinTelegraph — Crypto exchange HTX sees outflows top $258M following exploit","type":"news_article","url":"https://cointelegraph.com/news/crypto-exchange-htx-outflow-258-million-hack-november"},{"credibility":2,"name":"BankInfoSecurity — Cryptohack Roundup: Heco Loses $87 Million to Hack Attack","type":"news_article","url":"https://www.bankinfosecurity.com/cryptohack-roundup-87-million-heco-hack-a-23679"}]},{"content":"On November 25, 2024, HTX announced that HECO Chain would permanently cease operations on January 15, 2025, ending approximately four years of operation. The official rationale cited the 'prolonged market downturn and steady growth of competitors' including Ethereum, Solana, BSC, Avalanche, and TRON. Security researchers and industry analysts noted that the November 2023 hack had materially accelerated the platform's decline by damaging user confidence and prompting migrations to competing networks. Users holding HRC20 assets (including HRC20ETH, HRC20USDT, HRC20LINK, HRC20USDC, HRC20UNI, HRC20SHIB, HRC20HBTC, HRC20TUSD) were required to deposit holdings to a designated address before January 10, 2025, for conversion into points redeemable for HTX tokens distributed across 12 tranches. The shutdown was the first major blockchain infrastructure closure directly traceable to a security incident of this magnitude in the HECO ecosystem.","heading":"HECO Chain Shutdown (January 2025)","severity":"high","sources":[{"credibility":2,"name":"Blockonomi — HECO Chain Announces January 2025 Closure, Users Urged to Redeem Assets","type":"news_article","url":"https://blockonomi.com/heco-chain-announces-january-2025-closure-users-urged-to-redeem-assets/"},{"credibility":3,"name":"Dapp.expert — HECO to Officially Shutdown in January 2025","type":"news_article","url":"https://dapp.expert/news/en_heco-to-officially-shutdown-in-january-2025-key-information-for-users"}]},{"content":"On March 22, 2023 — approximately eight months before the HECO/HTX hack — the U.S. Securities and Exchange Commission filed charges against Justin Sun and three of his companies (Tron Foundation Limited, BitTorrent Foundation Ltd., and Rainberry Inc.) for the alleged unregistered offer and sale of crypto asset securities TRX and BTT, fraudulent wash trading to manipulate TRX secondary markets, and orchestrating undisclosed celebrity promotion schemes. The complaint was filed in the U.S. District Court for the Southern District of New York. Sun and the SEC subsequently entered preliminary settlement discussions that paused the litigation. The pre-existing regulatory scrutiny added additional reputational and legal complexity to HTX's response to the November 2023 security incidents.","heading":"Regulatory Context: SEC Charges Against Justin Sun","severity":"high","sources":[{"credibility":1,"name":"SEC.gov — SEC Charges Crypto Entrepreneur Justin Sun and His Companies for Fraud and Other Securities Law Violations","type":"regulatory","url":"https://www.sec.gov/newsroom/press-releases/2023-59"},{"credibility":1,"name":"CoinDesk — Tron Founder Justin Sun Sued by U.S. SEC on Securities, Market Manipulation Charges","type":"news_article","url":"https://www.coindesk.com/policy/2023/03/22/tron-founder-justin-sun-sued-by-us-sec-on-securities-market-manipulation-charges"},{"credibility":2,"name":"The Defiant — SEC and Justin Sun Pause Tron Fraud Lawsuit for Settlement Talks","type":"news_article","url":"https://thedefiant.io/news/regulation/sec-and-justin-sun-pause-tron-fraud-lawsuit-for-settlement-talks"}]}],"sources_used":[{"name":"CoinDesk — Justin Sun Confirms HTX, Heco Chain Exploited","type":"news_article","url":"https://www.coindesk.com/tech/2023/11/22/justin-sun-confirms-htx-heco-chain-exploited-after-100m-in-suspicious-transfers"},{"name":"CertiK — Heco Bridge Exploit","type":"research","url":"https://www.certik.com/resources/blog/heco-bridge-exploit"},{"name":"Hacken — Heco Bridge Hack Explained","type":"research","url":"https://hacken.io/insights/heco-bridge-hack-explained/"},{"name":"ImmuneBytes — HECO Bridge Exploited for Over $87M","type":"research","url":"https://immunebytes.com/blog/heco-bridge-exploited-for-over-87m-in-a-suspected-private-key-leak/"},{"name":"Blockworks — Heco chain bridge drained of $87M","type":"news_article","url":"https://blockworks.co/news/htx-hack-ethereum-crypto-assets"},{"name":"Elliptic — North Korean Hackers Return to Tornado Cash","type":"research","url":"https://www.elliptic.co/blog/north-korean-hackers-return-to-tornado-cash-despite-sanctions"},{"name":"CoinDesk — North Korean Hackers Used Tornado Cash to Launder $12M from Heco Bridge Hack","type":"news_article","url":"https://www.coindesk.com/business/2024/03/14/north-korean-hackers-used-tornado-cash-to-launder-12m-from-heco-bridge-hack-elliptic"},{"name":"The Block — Heco Bridge exploiters launder over $145 million via Tornado Cash","type":"news_article","url":"https://www.theblock.co/post/284107/heco-bridge-exploiters-launder-145-million-usd-eth-tornado-cash"},{"name":"CoinTelegraph — HECO Chain exploiter anonymizes $145M of Ether on Tornado Cash","type":"news_article","url":"https://cointelegraph.com/news/heco-exploiter-anonymizes-145-m-ether-tornado-cash"},{"name":"CoinTelegraph — Crypto exchange HTX sees outflows top $258M following exploit","type":"news_article","url":"https://cointelegraph.com/news/crypto-exchange-htx-outflow-258-million-hack-november"},{"name":"CoinTelegraph — HTX exchange loses $13.6M in hot wallet hack","type":"news_article","url":"https://cointelegraph.com/news/htx-exchange-loses-14-million-hot-wallet-hack"},{"name":"CoinDesk — Crypto Exchange HTX Lost $8M of Ether Due to a Hack, Justin Sun Says","type":"news_article","url":"https://www.coindesk.com/business/2023/09/25/crypto-exchange-htx-lost-8m-of-ether-due-to-a-hack-justin-sun-says"},{"name":"Halborn — Explained: The Huobi Exchange Hack (September 2023)","type":"research","url":"https://www.halborn.com/blog/post/explained-the-huobi-exchange-hack-september-2023"},{"name":"Decrypt — Justin Sun-Owned Exchange Poloniex Hacked for At Least $126 Million","type":"news_article","url":"https://decrypt.co/205465/justin-sun-owned-crypto-exchange-poloniex-hacked-60m"},{"name":"SEC.gov — SEC Charges Crypto Entrepreneur Justin Sun and His Companies for Fraud","type":"regulatory","url":"https://www.sec.gov/newsroom/press-releases/2023-59"},{"name":"Blockonomi — HECO Chain Announces January 2025 Closure","type":"news_article","url":"https://blockonomi.com/heco-chain-announces-january-2025-closure-users-urged-to-redeem-assets/"},{"name":"Olympix — Heco Bridge Hack Analysis","type":"research","url":"https://olympixai.medium.com/heco-bridge-hack-analysis-64cffda76684"},{"name":"South China Morning Post — Crypto exchange HTX suffers US$30 million hack","type":"news_article","url":"https://www.scmp.com/tech/big-tech/article/3242535/crypto-exchange-htx-suffers-us30-million-hack-after-another-platform-linked-entrepreneur-justin-sun"},{"name":"Investing.com — Justin Sun pledges to reimburse HTX users after $86.6 million HECO Chain exploit","type":"news_article","url":"https://ng.investing.com/news/stock-market-news/justin-sun-pledges-to-reimburse-htx-users-after-866-million-heco-chain-exploit-93CH-1150520"}],"summary":"On November 22, 2023, the HECO Chain cross-chain bridge and the HTX exchange (formerly Huobi), both linked to entrepreneur Justin Sun, were simultaneously exploited in what security researchers attributed to a private key compromise. The HECO bridge lost approximately $87 million in various tokens; additional HTX hot wallet losses brought confirmed totals to roughly $113 million. Blockchain analytics firm Elliptic subsequently attributed the attack to North Korea's Lazarus Group, which began laundering funds through Tornado Cash in March 2024.","timeline":[{"date":"2023-09-24","event":"HTX (formerly Huobi) hot wallet exploited for 5,000 ETH (~$8 million). Justin Sun offers 5% white hat bounty.","source":"CoinDesk","source_url":"https://www.coindesk.com/business/2023/09/25/crypto-exchange-htx-lost-8m-of-ether-due-to-a-hack-justin-sun-says"},{"date":"2023-10-07","event":"September HTX hacker returns 4,997 ETH after receiving 250 ETH (~$410,000) white hat bounty; on-chain message confirms private key leak as root cause.","source":"Bitcoin Insider","source_url":"https://www.bitcoininsider.org/article/228781/htx-huobi-hacker-returns-8-million-stolen-crypto-and-leaves-message-behind"},{"date":"2023-11-10","event":"Justin Sun-owned Poloniex exchange hacked for approximately $120–126 million via hot wallet compromise; $10M white hat bounty offered.","source":"Decrypt","source_url":"https://decrypt.co/205465/justin-sun-owned-crypto-exchange-poloniex-hacked-60m"},{"date":"2023-11-22","event":"HECO Chain cross-chain bridge exploited for approximately $87 million via operator private key compromise; HTX hot wallets simultaneously drained for an additional ~$26 million. Total losses approximately $113 million.","source":"CoinDesk","source_url":"https://www.coindesk.com/tech/2023/11/22/justin-sun-confirms-htx-heco-chain-exploited-after-100m-in-suspicious-transfers"},{"date":"2023-11-22","event":"Justin Sun publicly confirms exploits, pledges full compensation for HTX losses, and suspends deposits and withdrawals.","source":"Investing.com","source_url":"https://ng.investing.com/news/stock-market-news/justin-sun-pledges-to-reimburse-htx-users-after-866-million-heco-chain-exploit-93CH-1150520"},{"date":"2023-11-25","event":"HTX resumes deposit and withdrawal services approximately three days after the hack.","source":"CoinTelegraph","source_url":"https://cointelegraph.com/news/htx-huobi-bitcoin-withdrawal-deposit-back-after-hot-wallet-hack"},{"date":"2023-12-10","event":"HTX records approximately $258 million in net outflows since resuming services on November 25, reflecting post-hack loss of user confidence.","source":"CoinTelegraph","source_url":"https://cointelegraph.com/news/crypto-exchange-htx-outflow-258-million-hack-november"},{"date":"2024-03-13","event":"Lazarus Group (alleged) begins laundering HECO bridge/HTX hack proceeds through Tornado Cash, approximately four months after the theft.","source":"Elliptic","source_url":"https://www.elliptic.co/blog/north-korean-hackers-return-to-tornado-cash-despite-sanctions"},{"date":"2024-03-14","event":"Elliptic attributes the November 2023 HTX and HECO bridge hack to North Korea's Lazarus Group; reports $12 million laundered via Tornado Cash.","source":"CoinDesk","source_url":"https://www.coindesk.com/business/2024/03/14/north-korean-hackers-used-tornado-cash-to-launder-12m-from-heco-bridge-hack-elliptic"},{"date":"2024-03-22","event":"On-chain analysts report total HECO bridge exploit proceeds laundered via Tornado Cash exceed $145 million in ETH over an 8-day period.","source":"CoinTelegraph","source_url":"https://cointelegraph.com/news/heco-exploiter-anonymizes-145-m-ether-tornado-cash"},{"date":"2024-11-25","event":"HTX announces permanent closure of HECO Chain effective January 15, 2025; users instructed to redeem HRC20 assets before January 10, 2025.","source":"Blockonomi","source_url":"https://blockonomi.com/heco-chain-announces-january-2025-closure-users-urged-to-redeem-assets/"},{"date":"2025-01-15","event":"HECO Chain officially shuts down after approximately four years of operation.","source":"Blockonomi","source_url":"https://blockonomi.com/heco-chain-announces-january-2025-closure-users-urged-to-redeem-assets/"}]},"v":1}