HTX

What happened

On November 22, 2023, Huobi HTX suffered a breach of three hot wallets when an attacker gained access to private keys stored on exchange servers. User assets and reserves were converted to Ether and transferred out, with initial hot wallet losses of $13.6M and additional impact from related HECO Chain bridge losses.

Details

Date

Nov 22, 2023

Kind

Hack or exploit

Method

Hot Wallet Key Compromised

How in

Keys, accounts and infrastructure

Target

Centralized exchange

Chains

Ethereum

Sector

CEX (DefiLlama protocol id)

What would have stopped it all controls for this way in

• No one machine, person or organisation can move hot funds alone: keys in HSMs or MPC, threshold signers on separate infrastructure.
  Check: List every key that can move funds. For each: where it lives, who and what can reach it. Two keys behind one login count as one.
• The hot wallet holds only what a day of withdrawals needs; the rest is cold.
  Check: A written cap for the hot share of reserves, and a daily check against it.
• Freeze contacts are arranged before they are needed: stablecoin issuers, the large exchanges, SEAL 911.
  Check: A contact sheet with named people, confirmed this quarter; one drill sending a freeze request.

General guidance for this kind of attack, not a finding about this incident.

How sure: 0 of 4 checks what the checks mean

• Witnessesone source so far
• Same storyneeds a second source
• Blockchain receiptno public attack transaction checked
• Official wordno official statement linked

Who says what

• DefiLlama ↗$13.6M

Figure used: $13.6M, the figure DefiLlama gives. Each source's own figure is in dollars at the time.

Related incidents